@reason-machines/cli-linux-x64 0.2.415 → 0.2.418

package/bin/vm-hands/vm-hands-entry-lite-2wvsyggd.js

@@ -1,540 +0,0 @@
-// @bun
-import{Ye,xt,gr,dn,_r,pn,hn,fn}from"./vm-hands-entry-lite-ab2m9erf.js";import{ke,Vt,$n,lt,ho,ie,fo,mo,Ve,Ce,Vr,Fn,dt,Ae,pt,Un,Hn,qn,zn,Wn,Vn,Gn,Kn,Jn,Zn,Xn,Yn,Qn,ei,ti,pe,X,Pe,q,ri,ni,ii,oi,si,ai,ci,li,ht,ui}from"./vm-hands-entry-lite-k278g9kj.js";import{ue,J,T,H}from"./vm-hands-entry-lite-8t9xssf9.js";import{k,Nt}from"./vm-hands-entry-lite-22kfyvnk.js";import{p,yt,tn,Qt,wt,Si,Ei,er,tr,xi,rr,ki,Je,Ci,Ai,Pi,Ti,nr,Ri,Oi,ir,or,sr,Ne,rn,nn,ar,Di,on,cr,me,ge,bt,lr,dr,sn,an,Ze,vt}from"./vm-hands-entry-lite-463m6ejk.js";import{D,O,S}from"./vm-hands-entry-lite-9c95p6n9.js";import{G}from"./vm-hands-entry-lite-f5e3dbgk.js";import{Me}from"./vm-hands-entry-lite-88swf2qr.js";import{Er,j}from"./vm-hands-entry-lite-q0k6kx6d.js";import{hr,cn,Mi}from"./vm-hands-entry-lite-b885gwfh.js";import{Yi,Qi,ot,eo,to,ro,no,io}from"./vm-hands-entry-lite-eqgj4acy.js";import{wr,Tt,br,_n,yn}from"./vm-hands-entry-lite-1rtkf2xm.js";import{ji,P,Ui,At,Be,Pt}from"./vm-hands-entry-lite-ewwx4fr3.js";import{Zi,Xi}from"./vm-hands-entry-lite-2wgdvb15.js";import{kt,mn,gn}from"./vm-hands-entry-lite-qxchbbew.js";import{_e}from"./vm-hands-entry-lite-pmcz7j7t.js";import{b,h}from"./vm-hands-entry-lite-09m2cdkw.js";import{Et}from"./vm-hands-entry-lite-hj8n59y9.js";import{Se,Bt,Ft,jt,E}from"./vm-hands-entry-lite-pgb514h0.js";import{a,ne,qt,uo}from"./vm-hands-entry-lite-89z488gz.js";import{Gr,y,t,A,o,d,Lo,Te,fi,u,i,Q,_,oe,s,n,yo,Kr}from"./vm-hands-entry-lite-907pa7f9.js";import{fe,se,Kt,Jt,Oe,Zr}from"./vm-hands-entry-lite-9ay6f56v.js";import{Ie}from"./vm-hands-entry-lite-8ns59paz.js";import{r}from"./vm-hands-entry-lite-qy9xg6em.js";import{request as Pl}from"http";import{request as Cl}from"https";import{lookup as Ol}from"dns/promises";import{isIP as Il}from"net";async function Al(e){let c=new URL(e.url);return await new Promise((l,m)=>{let f=(c.protocol==="https:"?Cl:Pl)(c,{method:"POST",headers:{...e.headers,"accept-encoding":"identity"},signal:e.signal,timeout:dn},(g)=>l({response:g,close:()=>{g.destroy(),f.destroy(),g.socket?.destroy()}}));f.once("error",m),f.once("timeout",()=>f.destroy(Object.assign(Error("custom_endpoint_timeout"),{code:"ETIMEDOUT"}))),f.end(e.body)})}var Bs=new Set(["ENOTFOUND","EAI_AGAIN","EAI_NONAME","EAI_NODATA","EAI_FAIL","DNSException"]),Ll=new Set(["ECONNREFUSED","ETIMEDOUT","ECONNRESET","EHOSTUNREACH","ENETUNREACH","EHOSTDOWN","ENETDOWN","EPIPE","ECONNABORTED","EADDRNOTAVAIL","ConnectionRefused","ConnectionClosed","ConnectionTimedOut","Timeout"]);function Fs(e,c=0){if(!e||typeof e!=="object"||c>3)return null;let l=e.code;if(typeof l==="string"){if(Bs.has(l))return"custom_endpoint_host_not_found";if(Ll.has(l))return"custom_endpoint_connection_failed";if(/^(?:ERR_TLS_|ERR_SSL_|CERT_|UNABLE_TO_(?:GET|VERIFY|DECRYPT)|DEPTH_ZERO_SELF_SIGNED|SELF_SIGNED_CERT|HOSTNAME_MISMATCH|EPROTO$)/.test(l))return"custom_endpoint_tls_failed"}for(let m of[...e instanceof AggregateError?e.errors:[],e.cause]){let f=Fs(m,c+1);if(f)return f}return null}async function kl(e,c){let l=Fs(e),m=new URL(c).hostname.replace(/^\[|\]$/g,"");if(l!==null&&l!=="custom_endpoint_connection_failed"||Il(m)!==0)return l;let f;return await Promise.race([Ol(m).then(()=>!0,(w)=>!Bs.has(String(w?.code))),new Promise((w)=>{f=setTimeout(()=>w(!0),5000)})]).finally(()=>clearTimeout(f))?l:"custom_endpoint_host_not_found"}function Tl(e){for(let c=42;;c++){if(c===127)c=256;let l=String.fromCodePoint(c);if(!e.includes(l))return l}}function Dl(e,c){let l=Buffer.from(e),m=Buffer.from(c),f=new Uint32Array(l.length);for(let w=1,x=0;w<l.length;w++){while(x&&l[w]!==l[x])x=f[x-1];if(l[w]===l[x])x++;f[w]=x}let g=0;return(w,x=!1)=>{let C=Buffer.allocUnsafe(w.length*m.length+g),R=0;for(let v of w){while(g&&l[g]!==v){let I=f[g-1];R+=l.copy(C,R,0,g-I),g=I}if(l[g]===v){if(g++,g===l.length)R+=m.copy(C,R),g=0}else C[R++]=v}if(x)R+=l.copy(C,R,0,g),g=0;return C.subarray(0,R)}}async function Us(e){e.signal.throwIfAborted();let c=pn.safeParse(e.payload);if(!c.success)throw new r("custom_endpoint_invalid_request","Invalid local model request.");let l=c.data,m=hn.parse(await e.credential(e.signal));if(!_r(l,{baseUrl:l.baseUrl,api:m.api,execution:"device"}))throw new r("custom_endpoint_invalid_request","The request does not match the configured API.");e.signal.throwIfAborted();let f,g,w=0,x=0,C=0,R=Tl(m.apiKey),v=Dl(m.apiKey,R),I=async(N,M)=>{e.signal.throwIfAborted(),await new Promise((U,F)=>{let B=()=>{e.signal.removeEventListener("abort",B),F(e.signal.reason)};if(e.signal.addEventListener("abort",B,{once:!0}),e.signal.aborted){B();return}Promise.resolve().then(()=>(e.signal.throwIfAborted(),e.emit(N,M))).then(()=>{e.signal.removeEventListener("abort",B),U()},(V)=>{e.signal.removeEventListener("abort",B),F(V)})})},L=async(N)=>{if(w+=N.length,w>xt)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");for(let M=0;M<N.length;M+=Ye){if(C>=gr)throw new r("custom_endpoint_response_too_large","Local model response exceeds the chunk limit.");await I(`custom_endpoint.chunk.${C++}`,{eof:!1,data:N.subarray(M,M+Ye).toString("base64")})}};try{let N=await Al({url:l.url,body:l.body,signal:e.signal,headers:{...l.headers,...m.api==="anthropic-messages"?{"x-api-key":m.apiKey}:{authorization:`Bearer ${m.apiKey}`}}});f=N.response,g=N.close;let M=f.statusCode??500;if(M>=300&&M<400)throw new r("custom_endpoint_redirect_refused","Local model redirects are not followed.");if(f.headers["content-encoding"]&&f.headers["content-encoding"]!=="identity")throw new r("custom_endpoint_encoding_unsupported","The local server must honor identity encoding.");let U={};for(let F of["content-type","retry-after","x-request-id","request-id"]){let B=f.headers[F];if(typeof B==="string")U[F]=B.replaceAll(m.apiKey,R).slice(0,4096)}await I("custom_endpoint.headers",{status:M,statusText:(f.statusMessage??"").replaceAll(m.apiKey,R).slice(0,256),headers:U});for await(let F of f){e.signal.throwIfAborted();let B=Buffer.isBuffer(F)?F:Buffer.from(F);if(x+=B.length,x>xt)throw new r("custom_endpoint_response_too_large","Local model response exceeds the transport limit.");await L(v(B))}return await L(v(Buffer.alloc(0),!0)),await I(`custom_endpoint.chunk.${C}`,{eof:!0}),{bytes:w,chunks:C}}catch(N){if(e.signal.throwIfAborted(),N instanceof r)throw N;throw new r((f?null:await kl(N,l.url))??"custom_endpoint_request_failed","The local model server could not complete the request.")}finally{g?.()}}import{join as Hs}from"path";function Nl(e,c){return e===Hs(c,".ara","workspace")||e===Hs(c,".reason","workspace")}function js(e,c){let l=e.filter((m)=>Nl(m.path,c));return l.length===1?l[0].path:null}var Ml=/^[a-f0-9]{64}$/;var bo=32,$l=/^\/[^\x00-\x1f\x7f\\]*$/;function bn(e){if(typeof e!=="string"||e.length>4096||!$l.test(e))return!1;if(e==="/")return!0;return e.split("/").slice(1).every((c)=>c!==""&&c!=="."&&c!=="..")}function wn(e,c){let l=c==="win32"?/^([A-Za-z]):[\\/]*(.*)$/.exec(e):null;if(!l)return e;let m=l[2].split(/[\\/]+/).filter(Boolean).join("/");return`/${l[1].toUpperCase()}:${m?`/${m}`:""}`}function wo(e){if(!e||typeof e!=="object"||Array.isArray(e))return;let c=e;if(!bn(c.home)||!Array.isArray(c.roots)||c.roots.length>bo)return;let l=[];for(let m of c.roots){if(!m||typeof m!=="object"||Array.isArray(m))return;let{path_fingerprint:f,path:g}=m;if(typeof f!=="string"||!Ml.test(f)||!bn(g))return;l.push({path_fingerprint:f,path:g})}return{home:c.home,roots:l}}function Bl(e){let c=/^Reason contributor (rc_[0-9a-f]{32})$/.exec(e.name)?.[1];return e.email.toLowerCase()==="343777287+reason-contributors@users.noreply.github.com"&&c?c:void 0}function Fl(e){return Bl(e)??e.email.toLowerCase()}function So(e){let c=/^Co-authored-by:\s*([^<>\r\n]+) <([^<>\s]+)>$/i.exec(e.trim());return c?Fl({name:c[1],email:c[2]}):e.trim().toLowerCase()}var Pr=(e)=>e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/[a-z]/gi,(c)=>`[${c.toLowerCase()}${c.toUpperCase()}]`),Ul=[...Se.map((e)=>`/(${e.map(Pr).join("/")})(/|$)`),...Bt.map((e)=>`/(${e.map(Pr).join("/")})(/|$)`),...[...Ft].map((e)=>`/(${Pr(e)})$`),`/${Pr(".env.")}[^/]*$`,...jt.map((e)=>`/[^/]*${Pr(e)}$`)],Ws=`function localGithubSandboxProfile(root, temporary) {
-  return ['(version 1)','(deny default)','(import "system.sb")','(allow process-exec process-fork)',
-    '(allow file-read* (subpath "/bin") (subpath "/sbin") (subpath "/usr/bin") (subpath "/usr/sbin") (subpath "/usr/libexec") (subpath "/usr/share") (subpath "/private/var/select") (literal "/private/var/db/xcode_select_link"))',
-    '(allow file-read-metadata (path-ancestors "/opt/homebrew/bin") (path-ancestors "/usr/local/bin") (path-ancestors "/Library/Developer/CommandLineTools"))',
-    '(allow file-read* (subpath "/opt/homebrew/Cellar") (subpath "/opt/homebrew/opt") (subpath "/opt/homebrew/bin") (subpath "/opt/homebrew/lib") (subpath "/opt/homebrew/share") (subpath "/opt/homebrew/include") (subpath "/usr/local/Cellar") (subpath "/usr/local/opt") (subpath "/usr/local/bin") (subpath "/usr/local/lib") (subpath "/usr/local/share") (subpath "/usr/local/include") (subpath "/Library/Developer/CommandLineTools"))',
-    '(allow file-read* file-write* (subpath '+JSON.stringify(root)+') (subpath '+JSON.stringify(temporary)+'))',
-    '(allow file-read-metadata (path-ancestors '+JSON.stringify(root)+') (path-ancestors '+JSON.stringify(temporary)+'))',
-    '(deny file-read* file-write* (subpath "/opt/homebrew/etc") (subpath "/usr/local/etc") (literal "/private/etc/master.passwd"))',
-    '(deny file-write* (subpath "/opt/homebrew") (subpath "/usr/local") (subpath "/Library/Developer") (subpath "/cores"))',
-    ...${JSON.stringify(Ul)}.map(pattern => '(deny file-read* file-write* (regex #"'+pattern+'"))'),
-    '(deny network*)','(deny mach-lookup)','(deny process-info*)','(allow process-info* (target same-sandbox))','(allow process-info-listpids)','(allow file-read-metadata (subpath "/dev"))','(deny signal)','(allow signal (target same-sandbox))'].join('\\n');
-}`;import{spawn as jl,spawnSync as Wl}from"child_process";import*as ce from"fs";import*as ve from"path";import{homedir as ql}from"os";function qs(e,c,l,m="gh"){if(!["gh","git"].includes(m))throw Error("local_device_gh_unavailable");let f=e.realpathSync(l);if(process.platform==="win32"){let w=(x)=>x.toLowerCase()===f.toLowerCase()||x.toLowerCase().startsWith(f.toLowerCase()+c.sep);for(let x of new Set([process.env.ProgramW6432,process.env.ProgramFiles])){if(!x)continue;try{let C=e.realpathSync(m==="gh"?`${x}\\GitHub CLI\\gh.exe`:`${x}\\Git\\cmd\\git.exe`);if(!w(C)&&C.toLowerCase().startsWith(x.toLowerCase()+"\\")&&e.statSync(C).isFile())return C}catch{}}throw Error("local_device_gh_unavailable")}let g=m==="git"&&process.platform==="darwin"?"/Library/Developer/CommandLineTools/usr/bin/git":"/usr/bin/"+m;for(let w of["/opt/homebrew/bin/"+m,"/usr/local/bin/"+m,g])try{let x=e.realpathSync(w);if(x===f||x.startsWith(f+c.sep)||!["/opt/homebrew/","/usr/local/","/usr/bin/",...m==="git"?["/Library/Developer/CommandLineTools/"]:[]].some((R)=>x.startsWith(R)))continue;let C=e.statSync(x);if(!C.isFile()||(C.mode&18)!==0||![0,process.getuid()].includes(C.uid))continue;return e.accessSync(x,e.constants.X_OK),x}catch{continue}throw Error("local_device_gh_unavailable")}function Vs(e,c){let l=1;for(let m=0;m<c;m+=1)if(e.charCodeAt(m)===10)l+=1;return l}var Gs=[{name:"private_key",regex:/-----BEGIN\s+(?:[A-Z0-9_-]+\s+)?PRIVATE\s+KEY-----/i},{name:"github_pat",regex:/\bgh[pousr]_[A-Za-z0-9_]{36,}\b/},{name:"github_fine_grained_pat",regex:/\bgithub_pat_[A-Za-z0-9_]{36,}\b/},{name:"gitlab_pat",regex:/\bglpat-[0-9a-zA-Z_-]{20,}\b/},{name:"slack_token",regex:/\bxox[baprs]-[0-9]{10,}-[0-9]{10,}-[0-9a-zA-Z]{24}\b/},{name:"stripe_live_key",regex:/\b[sr]k_live_[0-9a-zA-Z]{24,}\b/},{name:"bearer_jwt",regex:/\bBearer\s+ey[A-Za-z0-9_-]{20,}\.ey[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/}];function vo(e){let c=e.trim().replaceAll("\\","/");if(!c)return{valid:!1,reason:"empty_path"};if(c.startsWith("/"))return{valid:!1,reason:"absolute_path_forbidden"};if(c.split("/").includes("..")||c.includes("../")||c.endsWith("/.."))return{valid:!1,reason:"path_traversal_forbidden"};if(c===".git"||c.startsWith(".git/")||c.includes("/.git/"))return{valid:!1,reason:"git_directory_entry_forbidden"};return{valid:!0}}function zs(e){return[...new Set(e.map((c)=>c.trim()).filter((c)=>c.length>=8))]}function Ks(e,c){return[...c.matchAll(new RegExp(e.regex.source,`${e.regex.flags}g`))]}function Sn(e,c=[],l={}){let m=[],f=l.published??new Set,g=zs(c).filter((w)=>!f.has(w));for(let w of e){let x=vo(w.path);if(!x.valid){m.push({path:w.path,reason:x.reason??"invalid_path"});continue}let C=w.content??"",R=g.map((v)=>({secret:v,offset:C.indexOf(v)})).filter((v)=>v.offset>=0).sort((v,I)=>v.offset-I.offset);if(R.length>0){let v=[...new Set(R.flatMap((I)=>l.secretNames?.(I.secret)??[]))];m.push({path:w.path,reason:"literal_secret_detected",ruleId:"forbidden_secret_value",line:Vs(C,R[0].offset),...v.length>0?{secretNames:v}:{}})}for(let v of Gs){let I=Ks(v,C).find((L)=>!f.has(L[0]));if(I){m.push({path:w.path,reason:`credential_pattern_detected: ${v.name}`,pattern:v.name,ruleId:v.name,line:Vs(C,I.index)});break}}}return{clean:m.length===0,violations:m,scannedObjectCount:e.length}}function Ys(e,c=[]){let l=zs(c),m=new Set;for(let{content:f}of e){for(let g of l)if(f.includes(g))m.add(g);for(let g of Gs)for(let w of Ks(g,f))m.add(w[0])}return[...m]}function Hl(e,c){let l=0;for(let m=e.indexOf(c);m>=0;m=e.indexOf(c,m+c.length))l+=1;return l}function Xs(e,c,l){let m=(f,g)=>f.reduce((w,x)=>w+Hl(x,g),0);return new Set(e.filter((f)=>m(c,f)<=m(l,f)))}var Ut=4194304,ct=process.platform==="win32",Or=process.env.SystemRoot??"C:\\Windows",Vl=(e)=>ct?Wl(ve.win32.join(Or,"System32","taskkill.exe"),["/PID",String(e),"/T","/F"],{stdio:"ignore",windowsHide:!0}):process.kill(-e,"SIGKILL"),Cr=ct?[ve.win32.join(Or,"System32"),Or].join(";"):"/usr/bin:/bin:/usr/sbin:/sbin",vn=ct?{SystemRoot:Or,WINDIR:Or}:{},Gl=(e)=>ct?ve.win32.resolve(e,"..","..","bin","sh.exe"):"/bin/sh",Js=536870912,Ro=/^[a-f0-9]{40}$/,zl=(e,c,l)=>new Promise((m)=>{if(l.signal?.aborted){m({status:null,error:Error("cancelled"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let f;try{f=jl(e,c,{cwd:l.cwd,env:l.env,...ct?{windowsHide:!0}:{detached:!0},stdio:["pipe","pipe","pipe"]})}catch{m({status:null,error:Error("spawn_failed"),stdout:Buffer.alloc(0),stderr:Buffer.alloc(0)});return}let g=Buffer.alloc(0),w=Buffer.alloc(0),x,C=!1,R=(N)=>{if(x??=Error(N),f.pid)try{Vl(f.pid)}catch{}},v=()=>R("cancelled"),I=setTimeout(()=>R("timeout"),l.timeout);l.signal?.addEventListener("abort",v,{once:!0});let L=(N)=>{if(C)return;C=!0,clearTimeout(I),l.signal?.removeEventListener("abort",v),m({status:N,stdout:g,stderr:w,...x?{error:x}:{}})};if(f.stdout.on("data",(N)=>{if(g.length+w.length+N.length>l.maxBuffer)R("output_limit");else g=Buffer.concat([g,N])}),f.stderr.on("data",(N)=>{if(g.length+w.length+N.length>l.maxBuffer)R("output_limit");else w=Buffer.concat([w,N])}),f.on("error",()=>{if(R("spawn_failed"),!f.pid)L(null)}),f.on("close",(N)=>L(N)),f.stdin.on("error",()=>R("input_failed")),f.stdin.end(l.input),l.signal?.aborted)v()}),Kl={command:zl,gh:(e,c)=>qs(ce,ve,e,c),home:ql};function Z(e){throw Error(e)}function Eo(e,c){let[l,m]=ct?[e.toLowerCase(),c.toLowerCase()]:[e,c];return m===l||m.startsWith(l+ve.sep)}function Yl(e,c){let l=new Set(e.split(/\r?\n/).map(So));return c.filter((m)=>{let f=So(m);if(l.has(f))return!1;return l.add(f),!0})}var Xl=new Set(["repoFullName","branch","head","base","defaultBranch","expectedBaseRef","baseSha","remoteHeadSha","expectedHeadSha"]),Jl=(e)=>JSON.stringify(e,(c,l)=>Xl.has(c)?void 0:l);function Zs(e,c,l){let m=[...new Set(e.map((g)=>`${c(g.path)}${g.line?`:${g.line}`:""} (${g.reason==="literal_secret_detected"?`value of ${g.secretNames?.length?g.secretNames.slice(0,3).join(", "):"a session variable"}`:`${g.ruleId??"credential"} credential`})`))].slice(0,10),f=e.some((g)=>g.reason==="literal_secret_detected");Z(`local_device_gh_secret_scan_failed: the change adds text matching a secret that the base does not already contain: ${m.join("; ")}. Nothing was sent. ${l}${f?" If the line is ordinary code, that variable's value is too generic to tell apart from code: tell the person which variable matched so they can change its value.":""}`)}async function Qs(e,c,l=Kl){let m=ke.parse(e),f="local_device_gh_prepare_setup";try{if(!["darwin","linux","win32"].includes(process.platform))Z("local_device_gh_platform_unavailable");c.assertCurrent();let g=ce.realpathSync(c.root);if(g===ve.parse(g).root)Z("local_device_gh_root_unavailable");if(!Ve(m)&&!c.forbiddenSecretValues)Z("local_device_gh_secret_scope_unavailable");if(!Ve(m)&&c.readOnly)Z("local_device_gh_read_only");if(!Ve(m)){let W=Sn([{path:"github-operation",content:Jl(m)}],c.forbiddenSecretValues,c.secretNames?{secretNames:c.secretNames}:{});if(!W.clean)Zs(W.violations,()=>`the ${m.kind} request text`,"Remove it from the pull request text and try again.")}let w=l.gh(g),x=l.home(),C=l.gh(g,"git"),R=c.privateDirectory?ce.realpathSync(c.privateDirectory):ce.realpathSync(x);if(!Ve(m)&&(!c.privateDirectory||Eo(g,R)))Z("local_device_gh_private_scope_unavailable");let v={...vn,PATH:ct?[ve.dirname(C),Cr].join(";"):Cr,HOME:x,GH_CONFIG_DIR:ct&&process.env.APPDATA?ve.join(process.env.APPDATA,"GitHub CLI"):ve.join(x,".config","gh"),GH_PROMPT_DISABLED:"1",GH_PAGER:ct?"":"/bin/cat",GH_HOST:"github.com",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1",...process.platform==="linux"?Object.fromEntries(["DBUS_SESSION_BUS_ADDRESS","XDG_RUNTIME_DIR"].flatMap((W)=>process.env[W]?[[W,process.env[W]]]:[])):{}},I=async(W,te,ae=R,he,xe=Ut)=>{c.assertCurrent();let Re=await l.command(W,te,{cwd:ae,env:v,input:he,maxBuffer:xe,timeout:Math.max(1,Math.min(60000,(c.deadlineMs??Date.now()+60000)-Date.now())),signal:c.signal});if(c.assertCurrent(),Re.error||Re.status!==0)Z("local_device_gh_command_failed");return Re.stdout},L=async(W)=>(await I(w,W)).toString("utf8").trim(),N=async(W,te="application/vnd.github+json")=>{fo(m.repoFullName,W,{headers:{accept:te}}),c.assertCurrent();let ae=await l.command(w,["api","--hostname","github.com","--method","GET","--include","-H",`Accept: ${te}`,W],{cwd:R,env:v,maxBuffer:Ut,timeout:Math.max(1,Math.min(25000,(c.deadlineMs??Date.now()+25000)-Date.now())),signal:c.signal});if(c.assertCurrent(),ae.error&&ae.status===null)Z("local_device_gh_response_unavailable");let he=ae.stdout.toString("utf8").match(/^HTTP\/[^ ]+ ([0-9]{3})[^\r\n]*\r?\n([\s\S]*?)\r?\n\r?\n([\s\S]*)$/);if(!he)Z("local_device_gh_response_invalid");let xe=Number(he[1]);if(xe>=200&&xe<300&&ae.status!==0)Z("local_device_gh_response_unavailable");if(Buffer.byteLength(he[3])>lt)Z("local_device_gh_response_too_large");let Re={};for(let qe of he[2].split(/\r?\n/)){let Ke=qe.indexOf(":"),Ct=qe.slice(0,Ke).toLowerCase();if(["link","content-type"].includes(Ct))Re[Ct]=qe.slice(Ke+1).trim().slice(0,8192)}return{kind:"read",status:xe,headers:Re,body:xe>=200&&xe<300?he[3]:JSON.stringify({message:"local_device_gh_request_failed"})}};if(m.kind==="read")return N(m.path,m.accept);if(m.kind==="pr_review_context"){let[W,te]=m.repoFullName.split("/"),ae=await L(["api","graphql","--hostname","github.com","-f",`query=${mo}`,"-f",`owner=${W}`,"-f",`repo=${te}`,"-F",`number=${m.number}`,...m.after?["-f",`after=${m.after}`]:[]]);if(Buffer.byteLength(ae)>lt)Z("local_device_gh_response_too_large");let he=JSON.parse(ae);if(he.errors||he.data?.repository?.nameWithOwner?.toLowerCase()!==m.repoFullName.toLowerCase()||he.data.repository.pullRequest?.number!==m.number)Z("local_device_gh_response_invalid");return{kind:"pr_review_context",body:ae}}if(m.kind==="pr_merge"){let W=await N(`/repos/${m.repoFullName}/pulls/${m.number}`),te=JSON.parse(W.body),ae=(Re)=>Re.number===m.number&&Re.html_url===`https://github.com/${m.repoFullName}/pull/${m.number}`&&Re.base?.repo?.full_name?.toLowerCase()===m.repoFullName.toLowerCase()&&Re.base?.ref===m.expectedBaseRef&&Re.head?.sha===m.expectedHeadSha;if(W.status!==200||!ae(te)||te.state!=="open"||te.draft!==!1||te.head?.sha!==m.expectedHeadSha||te.base?.repo?.full_name?.toLowerCase()!==m.repoFullName.toLowerCase())Z("local_device_gh_merge_target_changed");await L(["pr","merge",String(m.number),`--repo=${m.repoFullName}`,`--${m.method}`,"--match-head-commit",m.expectedHeadSha,...m.commitBody!==void 0&&m.method!=="rebase"?[`--body=${m.commitBody}`]:[]]);let he=await N(`/repos/${m.repoFullName}/pulls/${m.number}`),xe=JSON.parse(he.body);if(he.status!==200||!ae(xe)||xe.merged!==!0)Z("local_device_gh_merge_unconfirmed");return{kind:"pr_merge",number:m.number,merged:!0}}if(m.kind==="pr_create"){if(m.head===m.base)Z("local_device_gh_default_branch");let W=await L(["pr","create","--repo",m.repoFullName,"--head",m.head,"--base",m.base,`--title=${m.title}`,`--body=${m.body}`,...m.draft?["--draft"]:[]]);if(!new RegExp("^https://github\\.com/"+m.repoFullName.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")+"/pull/[1-9][0-9]*$").test(W))Z("local_device_gh_mutation_unconfirmed");return{kind:"pr_create",url:W}}if(m.kind==="pr_mutation"){let W=m.mutation,te=W.action==="edit"?["edit",...W.title!==void 0?[`--title=${W.title}`]:[],...W.body!==void 0?[`--body=${W.body}`]:[],...W.base?[`--base=${W.base}`]:[]]:W.action==="metadata"?["edit",`--${W.change}-${W.field}=${W.value}`]:W.action==="ready"?["ready"]:W.action==="draft"?["ready","--undo"]:["close"];return await L(["pr",...te,String(m.number),"--repo",m.repoFullName]),{kind:"pr_mutation",number:m.number,applied:!0}}if(!c.repoPath)Z("local_device_gh_workspace_unavailable");let M=ce.realpathSync(c.repoPath);if(!Eo(g,M))Z("local_device_gh_workspace_unavailable");let U=`https://github.com/${m.repoFullName}.git`,F="!'"+(ct?w.replace(/\\/g,"/"):w).replace(/'/g,"'\\''")+"' auth git-credential",B=Ie(Ws),V=(W,te,ae)=>process.platform==="darwin"?["/usr/bin/sandbox-exec",["-p",W,te,...ae]]:[te,ae],z=async(W,te,ae,he=Ut)=>{let xe=Eo(R,W),Re=["-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","credential.helper=","-c","http.extraheader=",...xe?["-c",`credential.https://github.com.helper=${F}`]:[],"-c","protocol.ext.allow=never","-c","protocol.file.allow=never","-c","protocol.ssh.allow=never",...te];if(xe)return I(C,Re,W,ae,he);let qe=ve.join(M,".ara-local-gh-tmp");if(ce.mkdirSync(qe,{recursive:!0,mode:448}),ce.lstatSync(qe).isSymbolicLink()||ce.realpathSync(qe)!==qe)Z("local_device_gh_workspace_unavailable");c.assertCurrent();let Ke=await l.command(...V(B(M,qe),C,Re),{cwd:W,input:ae,maxBuffer:he,timeout:Math.max(1,Math.min(25000,(c.deadlineMs??Date.now()+25000)-Date.now())),signal:c.signal,env:{...vn,PATH:Cr,HOME:M,TMPDIR:qe,GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1"}});if(c.assertCurrent(),Ke.error||Ke.status!==0)Z("local_device_gh_collection_failed");return Ke.stdout},Y=async(W,te)=>(await z(W,te)).toString("utf8").trim(),be=async(W,te)=>{let ae=ve.join(W,".ara-local-gh-tmp");if(ce.mkdirSync(ae,{recursive:!0,mode:448}),ce.lstatSync(ae).isSymbolicLink()||ce.realpathSync(ae)!==ae)Z("local_device_gh_workspace_unavailable");c.assertCurrent();let he=await l.command(...V(B(W,ae),Gl(C),["-c",'printf "%s\\n" "$1" > .git/shallow',"sh",te]),{cwd:W,maxBuffer:65536,timeout:Math.max(1,Math.min(25000,(c.deadlineMs??Date.now()+25000)-Date.now())),signal:c.signal,env:{...vn,PATH:Cr,HOME:W,TMPDIR:ae}});if(c.assertCurrent(),he.error||he.status!==0)Z("local_device_gh_materialization_failed")},K=async(W)=>{let te=new Map;if(W.length===0)return te;let ae=await z(De,["cat-file","--batch"],[...new Set(W)].join(`
-`)+`
-`,Ut*8);for(let he=0;he<ae.length;){let xe=ae.indexOf(10,he),[Re,qe,Ke]=ae.subarray(he,xe).toString("utf8").split(" ");if(xe<0||!Re||qe!=="blob"||!/^[0-9]+$/.test(Ke??""))Z("local_device_gh_object_invalid");te.set(Re,ae.subarray(xe+1,xe+1+Number(Ke)).toString("utf8")),he=xe+1+Number(Ke)+1}return te},re=async(W,te,ae)=>{let he=ve.join(M,".ara-local-gh-tmp"),xe=B(M,he)+`
-(allow file-read* file-write* (subpath ${JSON.stringify(M)}))
-(allow file-read* (subpath ${JSON.stringify(W)}))
-(allow file-read-metadata (path-ancestors ${JSON.stringify(W)}))`,Re=async(Ke,Ct)=>{c.assertCurrent();let vr=await l.command(...V(xe,Ke,Ct),{cwd:M,maxBuffer:Ut,timeout:Math.max(1,Math.min(25000,(c.deadlineMs??Date.now()+25000)-Date.now())),signal:c.signal,env:{...vn,PATH:Cr,HOME:M,TMPDIR:he,GIT_INDEX_FILE:ve.join(M,".git","index"),OPENSSL_CONF:"/dev/null",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_SYSTEM:"/dev/null",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_NO_REPLACE_OBJECTS:"1",GIT_LFS_SKIP_SMUDGE:"1"}});if(c.assertCurrent(),vr.error||vr.status!==0)Z("local_device_gh_materialization_failed")},qe=["--git-dir="+W,"--work-tree="+M,"-c","core.hooksPath=/dev/null","-c","core.fsmonitor=false","-c","credential.helper=","-c","http.extraheader=","-c","protocol.allow=never"];await Re(C,[...qe,"read-tree",te]),await Re(C,[...qe,"checkout-index","--all","--index"]),await z(M,["update-ref","refs/heads/"+ae,te]),await z(M,["symbolic-ref","HEAD","refs/heads/"+ae])};f="local_device_gh_prepare_metadata";let ee=await N(`/repos/${m.repoFullName}`);if(ee.status!==200)Z("local_device_gh_repository_unavailable");let Ue=JSON.parse(ee.body);if(Ue.full_name?.toLowerCase()!==m.repoFullName.toLowerCase()||Ue.default_branch!==m.defaultBranch||m.kind==="publish"&&Ue.permissions?.push!==!0)Z("local_device_gh_repository_authority_changed");if(m.branch===m.defaultBranch)Z("local_device_gh_default_branch");f="local_device_gh_prepare_private_init";let De=ce.mkdtempSync(ve.join(R,"github-publication-"));ce.chmodSync(De,448);let ln=!1;try{if(await z(De,["init","--bare","--template="]),m.kind==="prepare"){if(f="local_device_gh_prepare_fetch",await z(De,["fetch","--depth=1","--no-tags","--no-recurse-submodules",U,m.baseSha]),await Y(De,["rev-parse","FETCH_HEAD"])!==m.baseSha)f="local_device_gh_prepare_base_mismatch",Z("local_device_gh_base_changed");f="local_device_gh_prepare_checkout_validation";let $e=ve.join(M,".git"),nt=!1;if(ce.existsSync($e)){if(!ce.lstatSync($e).isDirectory()||ce.lstatSync($e).isSymbolicLink()||["objects/info/alternates","info/grafts"].some((je)=>ce.existsSync(ve.join($e,je))))Z("local_device_gh_repository_layout_invalid");let ze=await z(M,["rev-parse","--verify","-q","HEAD"]).then((je)=>je.toString("utf8").trim(),()=>null),it=await z(M,["config","--local","--get","remote.origin.url"]).then((je)=>je.toString("utf8").trim(),()=>"");if(ze!==null||it){if(ze!==m.baseSha||await Y(M,["branch","--show-current"])!==m.branch)Z("local_device_gh_checkout_exists");return{kind:"prepare",headSha:m.baseSha}}nt=!0}let Xe=ce.readdirSync(M).filter((ze)=>!(nt&&ze===".git")),mt=[".ara-local-gh-tmp",".reason-local-gh-tmp"];if(Xe.some((ze)=>!mt.includes(ze))||Xe.some((ze)=>{let it=ve.join(M,ze);return!ce.lstatSync(it).isDirectory()||ce.lstatSync(it).isSymbolicLink()||ce.readdirSync(it).length>0}))Z("local_device_gh_checkout_not_empty");if(f="local_device_gh_prepare_checkout_init",!nt)await z(M,["init","--template="]);f="local_device_gh_prepare_materialization";let gt=await z(De,["pack-objects","--stdout","--revs"],m.baseSha+`
-`,Js);return await be(M,m.baseSha),await z(M,["index-pack","--strict","--stdin"],gt,65536),await z(M,["remote","add","origin",U]),await re(De,m.baseSha,m.branch),{kind:"prepare",headSha:m.baseSha}}let W=ve.join(M,".git");if(!ce.lstatSync(W).isDirectory()||ce.lstatSync(W).isSymbolicLink()||["objects/info/alternates","info/grafts"].some(($e)=>ce.existsSync(ve.join(W,$e))))Z("local_device_gh_repository_layout_invalid");if(await Y(M,["branch","--show-current"])!==m.branch)Z("local_device_gh_branch_changed");let te=await Y(M,["rev-parse","--verify","HEAD"]);if(!Ro.test(te))Z("local_device_gh_head_invalid");let ae=await N(`/repos/${m.repoFullName}/commits/${m.baseSha}`);if(ae.status!==200||JSON.parse(ae.body).sha!==m.baseSha)Z("local_device_gh_base_unverified");let he=await N(`/repos/${m.repoFullName}/git/ref/heads/${encodeURIComponent(m.branch)}`);if(m.remoteHeadSha===null?he.status!==404:he.status!==200||JSON.parse(he.body).object?.sha!==m.remoteHeadSha)Z("local_device_gh_remote_changed");let xe=[...(await Y(M,["rev-list","--objects","--no-object-names",te,"--not",m.baseSha])).split(`
-`),...(await Y(M,["rev-list","--objects","--no-object-names","--no-walk",m.baseSha])).split(`
-`)].filter(Boolean);if(xe.some(($e)=>!Ro.test($e)))Z("local_device_gh_object_invalid");let Re=await z(M,["pack-objects","--stdout"],[...new Set(xe)].join(`
-`)+`
-`,Js);if(ce.writeFileSync(ve.join(De,"shallow"),m.baseSha+`
-`,{flag:"wx",mode:384}),await z(De,["index-pack","--strict","--stdin"],Re,65536),await z(De,["merge-base","--is-ancestor",m.baseSha,te]),m.remoteHeadSha)await z(De,["merge-base","--is-ancestor",m.remoteHeadSha,te]);let qe=await z(De,["show","-s","--format=%B",te]),Ke=(await z(De,["interpret-trailers","--parse"],qe)).toString("utf8"),Ct=m.contributorTrailers?{expectedTrailers:m.contributorTrailers,missingFromHead:Yl(Ke,m.contributorTrailers)}:void 0,vr=(await Y(De,["rev-list","--objects","--no-object-names",te,"--not",m.baseSha,...m.remoteHeadSha?[m.remoteHeadSha]:[]])).split(`
-`).filter(Boolean);if(vr.length>5000)Z("local_device_gh_collection_too_large");let xr=[],Ds=0;for(let $e of vr){if(!Ro.test($e))Z("local_device_gh_object_invalid");let nt=await Y(De,["cat-file","-t",$e]);if(!["blob","commit","tree"].includes(nt))Z("local_device_gh_object_invalid");let Xe=await z(De,["cat-file",nt,$e]);if(Ds+=Xe.length,Ds>Ut)Z("local_device_gh_collection_too_large");if(nt==="tree"){let mt=0;while(mt<Xe.length){let gt=Xe.indexOf(32,mt),ze=Xe.indexOf(0,gt+1);if(gt<mt||ze<=gt||ze+21>Xe.length)Z("local_device_gh_object_invalid");let it=Xe.subarray(gt+1,ze).toString("utf8");if(it.includes("/")||!vo(it).valid)Z("local_device_gh_object_invalid");mt=ze+21}}xr.push({path:`object-${$e}`,content:Xe.toString("utf8")})}let Ns=c.secretNames?{secretNames:c.secretNames}:{},Rr=Sn(xr,c.forbiddenSecretValues,Ns),Ms=new Map;if(!Rr.clean)try{let $e=(await z(De,["diff","--no-renames","--no-abbrev","--raw","-z",m.baseSha,te])).toString("utf8").split("\x00"),nt=[],Xe=[];for(let je=0;je+1<$e.length;je+=2){let[,Rl,El,_o,un]=$e[je].slice(1).match(/^([0-7]{6}) ([0-7]{6}) ([0-9a-f]{40}) ([0-9a-f]{40}) /)??[];if(!_o||!un)continue;if(Rl!=="160000"&&!/^0+$/.test(_o))nt.push(_o);if(El!=="160000"&&!/^0+$/.test(un))Xe.push(un),Ms.set(`object-${un}`,$e[je+1])}let mt=await K([...nt,...Xe]),gt=new Set(Rr.violations.map((je)=>je.path)),ze=Ys(xr.filter((je)=>gt.has(je.path)),c.forbiddenSecretValues),it=Xs(ze,Xe.map((je)=>mt.get(je)??""),nt.map((je)=>mt.get(je)??""));if(it.size>0)Rr=Sn(xr,c.forbiddenSecretValues,{...Ns,published:it})}catch{}if(!Rr.clean)Zs(Rr.violations,($e)=>Ms.get($e)??`an object in the pushed history (${$e})`,"Remove it from the files and commit again; a commit or message in the pushed history that holds it must be amended before this branch can be pushed.");await z(De,["push","--no-recurse-submodules",U,`${te}:refs/heads/${m.branch}`]);let $s=await N(`/repos/${m.repoFullName}/git/ref/heads/${encodeURIComponent(m.branch)}`);if($s.status!==200||JSON.parse($s.body).object?.sha!==te)Z("local_device_gh_push_unconfirmed");return{kind:"publish",headSha:te,scannedObjectCount:xr.length,...Ct?{attribution:Ct}:{}}}catch(W){throw ln=!0,W}finally{try{ce.rmSync(De,{recursive:!0,force:!0})}catch(W){if(!ln||m.kind!=="prepare")throw f=null,W}}}catch(g){if(m.kind==="prepare"&&m.diagnosticsVersion===1&&f&&!c.signal?.aborted)throw new Vt(f);throw g}}var Ht=i({profile:t().regex(/^(Default|Profile [0-9]+)$/),extension_instance_id:t().min(1).max(1024)}).strict(),Oo={ready:n(!0),boot_generation:t().uuid(),proof_ready:n(!1),result:n("metadata_only")},Zl=i({...Oo,version:n(2),development_only:n(!1),image:n(!0),video:n(!1),source_bound:n(!1),profiles:u(Ht.shape.profile).min(1).max(16),extension_instance_ids:u(Ht.shape.extension_instance_id.max(512)).min(1).max(16)}).strict().refine((e)=>new Set(e.profiles).size===e.profiles.length&&e.profiles.length===e.extension_instance_ids.length),Ql=i({...Oo,version:n(3),development_only:n(!1),image:n(!0),video:n(!0),source_bound:n(!1),max_seconds:n(15),profiles:u(Ht.shape.profile).min(1).max(16),extension_instance_ids:u(Ht.shape.extension_instance_id.max(512)).min(1).max(16)}).strict().refine((e)=>new Set(e.profiles).size===e.profiles.length&&e.profiles.length===e.extension_instance_ids.length),Io=Q([Zl,Ql]),Hf=Q([i({...Oo,version:n(1),development_only:n(!0),profile:Ht.shape.profile,extension_instance_id:Ht.shape.extension_instance_id,max_seconds:n(15)}).strict(),Io]);import{randomUUID as $o}from"crypto";import{spawn as ud}from"child_process";import{existsSync as ca,lstatSync as pd,mkdirSync as md,readFileSync as fd,realpathSync as Bo,rmSync as mh,writeFileSync as hd}from"fs";import{dirname as gd,join as _t,relative as _d,sep as yd}from"path";var ed=600000,td=1800000,rd=20000;var ea=i({action:n("start"),request_id:t().uuid(),command:t().min(1).max(16000).refine((e)=>!e.includes("\x00")),cwd:t().min(1).max(4096).refine((e)=>!e.includes("\x00")&&!e.startsWith("/")&&!e.split(/[\\/]/).includes("..")).describe("Path relative to the granted device root; omit to use that root. Must not start with /, contain a .. path segment, or contain a NUL character.").optional(),mode:s(["host","confined"]).default("host"),timeout_ms:o().int().min(1000).max(td).default(ed).describe("Absolute process budget including queue and startup time. Defaults to ten minutes; longer explicit requests require the selected root's advertised max_timeout_ms. Retrying never renews the deadline.")}).strict(),To={device_id:t().uuid(),root_id:t().uuid()},nd=_("action",[ea.extend(To),i({...To,action:n("inspect"),process_id:t().uuid(),after:o().int().min(0).default(0),wait_ms:o().int().min(0).max(rd).default(0).describe("Wait for new output or a state change, bounded by this call's wait budget. Expiring this wait does not cancel the process or extend its deadline.")}).strict(),i({...To,action:n("cancel"),process_id:t().uuid()}).strict()]),qf=Gr(nd,{io:"input"}),Vf=ea.extend({process_brain_fence:t().uuid(),process_expires_at:y.datetime()}).strict(),Ar=i({version:n(1),process_id:t().uuid(),state:s(["starting","running","exited","cancelled","expired","uncertain"]),exit_code:o().int().nullable(),first_cursor:o().int().min(0),next_cursor:o().int().min(0),truncated:d(),observed_at:y.datetime(),output:u(i({cursor:o().int().min(1),stream:s(["stdout","stderr"]),text:t().max(32768)}).strict()).max(128)}).strict().refine((e)=>{if(Buffer.byteLength(JSON.stringify(e))>1e5||e.next_cursor<e.first_cursor-1)return!1;if((e.state==="starting"||e.state==="running"||e.state==="uncertain")&&e.exit_code!==null)return!1;if(e.state==="exited"&&(e.exit_code===null||e.exit_code<0||e.exit_code>255))return!1;if(e.state==="cancelled"&&e.exit_code!==130||e.state==="expired"&&e.exit_code!==124)return!1;let l=e.first_cursor-1;for(let m of e.output){if(m.cursor<=l||m.cursor>e.next_cursor)return!1;l=m.cursor}return!0});var Gf=i({operation_constraints:oe(t(),Te())}),zf=i({ready:n(!0),version:n(1),execution_mode:s(["host","confined"]),max_timeout_ms:o().int().min(1000).optional()});var od=i({version:n(1),process_id:t().uuid(),state:s(["queued","cancelled_before_start","not_started"]),exit_code:Lo(),output:u(fi()).length(0),first_cursor:n(0),next_cursor:n(0),truncated:n(!1),cancellation_requested:n(!1),reason_code:s(["cancelled_before_start","process_journal_capacity","path_not_found","process_timeout_unsupported"]).optional(),expires_at:y.datetime().optional().describe("Accepted absolute process deadline. Reading, waiting and retrying do not extend it.")}).strict(),id=i({...Ar.shape,state:s(["queued","starting","running","exited","cancelled","expired","uncertain","cancelled_before_start","not_started"]),observed_at:y.datetime().optional(),expires_at:y.datetime().optional().describe("Accepted absolute process deadline. Reading, waiting and retrying do not extend it."),cancellation_requested:d(),reason_code:t().nullable().optional(),execution_authority:n("lost").optional().describe("Historical receipt only; the current Brain cannot control this older-generation process."),recovery:i({cause:n("brain_generation_changed"),terminal_confirmed:d(),next_step:s(["inspect_until_terminal","reconcile_effects_before_new_intent"])}).strict().optional().describe("Historical process recovery only. An unconfirmed outcome forbids replay. A confirmed terminal observation proves the old process stopped, not that its command had no effects. Reconcile the result; only restart still-needed, safely repeatable work with a new request_id and current authority. Respect user cancellation."),last_observed_state:Ar.shape.state.or(n("cancelled_before_start")).nullable().optional().describe("Last saved observation before authority was lost; a running observation does not establish current child liveness.")}).strict(),Kf=Gr(id),Yf=Q([Ar,od.refine((e)=>e.state==="cancelled_before_start")]),Do=i({version:n(1),process_id:t().uuid(),state:s(["exited","cancelled","expired"]),exit_code:o().int().min(0).max(255),observed_at:y.datetime()}).strict().refine((e)=>(e.state!=="cancelled"||e.exit_code===130)&&(e.state!=="expired"||e.exit_code===124)),Xf=i({process_terminal_observation:Do}).strict();var ta="preview.serve.v1",ra=43200000;var na=1,No="gid_proxy_v1",oa="egress",Mo=/^(?:\*\.)?[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?(?::[1-9][0-9]{0,4})?$/,sd=i({version:n(No),allowed_domains:u(t().max(260).regex(Mo)).max(1024)}).strict(),ad=Kr((e)=>H(e)!==null,"invalid workspace"),cd=i({version:n(1),request_id:A(),session_id:A(),command:t().min(1).max(16000).refine((e)=>!e.includes("\x00")),port:o().int().min(1024).max(65535),workspace:ad,egress:sd.optional()}).strict(),ia=cd.extend({expires_at:y.datetime()}).strict();var ld=4,dd=5000;function sa(e,c,l){let m=null;try{m=yt(e)}catch{}tn({deviceRelayUrl:m?.deviceRelayUrl??"",binding:m?.binding??null,jobId:c,port:m?.binding.port??0,reason:m?l:"binding_invalid"})}function aa(e){let c=new Map;return{open(l){let m=(v)=>sa(l,e.claim.operation_id,v),f;try{f=yt(l)}catch{return m("binding_invalid")}let{binding:g,deviceRelayUrl:w}=f,x=e.claim.owner;if(!x||g.organizationId!==x.organization_id||g.userId!==x.user_id||g.deviceId!==x.device_id||g.rootId!==e.claim.root_id||g.jobId!==e.claim.operation_id||g.fenceId!==e.claim.operation_id||g.generation!==na||g.expiresAtMs>Math.min(Date.now()+p.lifetimeMs+dd,e.expiresAtMs))return m("binding_mismatch");if(g.expiresAtMs<=Date.now())return m("binding_expired");if(c.get(g.port)?.abort(),c.delete(g.port),c.size>=ld)return m("preview_capacity");let C=new AbortController;c.set(g.port,C);let R=er({binding:g,deniedPorts:e.deniedPorts,readCurrentJob:async()=>{if(C.signal.aborted)return null;let v=await e.inspect();return v?{binding:g,executorLaunchId:e.executorLaunchId,job:v}:null}});Qt({binding:g,deviceRelayUrl:w,port:R,signal:C.signal}).then((v)=>v.closed,(v)=>{let I=v instanceof Error?v.message:"preview_failed";if(I!=="preview_not_authorized")process.stderr.write(`${JSON.stringify({event:"worker_preview.open_failed",job_id:g.jobId,port:g.port,reason_code:I})}
-`)}).finally(()=>{if(c.get(g.port)===C)c.delete(g.port)})},dispose(){for(let l of c.values())l.abort();c.clear()}}}class Lr extends r{observation;constructor(e){super("process_authority_lost","Process authority was lost; the owned process group has stopped.");this.observation=e}}var ua=256,bd=new Map,wd="preview.serve.v1",Fo=new Map;function Sd(e){let c=Fo.get(e.operation_id);if(c){if(c.claim!==e)throw st("process_authority_lost");return c}if(Fo.size>=ua)throw st("process_journal_capacity");let l={claim:e,executing:!1,cancelRequested:!1,phase:"pending"};return Fo.set(e.operation_id,l),l}function la(e){return{version:1,process_id:e,state:"cancelled_before_start",exit_code:null,output:[],first_cursor:0,next_cursor:0,truncated:!1,cancellation_requested:!1,reason_code:"cancelled_before_start"}}var da=(e)=>new Promise((c)=>setTimeout(c,e)),st=(e="process_outcome_uncertain")=>new r(e,"The managed process outcome could not be confirmed; inspect its saved receipt before starting another intent.");function vd(e=a(),c=xd()){let l=gd(Er({},e)),m=_d(qt(e),l),[f,...g]=m.split(yd);return{directory:_t(c,m,"processes"),previous:[_t(l,"processes"),...f==="reason"?[_t(c,"ara",...g,"processes")]:[]]}}function xd(){if(process.platform!=="darwin")throw new r("process_unavailable","Managed Mac process execution is unavailable.");let e=uo();if(!e)throw new r("process_unavailable","The private per-user process directory is unavailable.");return e}async function Uo(e){if(!e.claim.owner||e.signal.aborted||e.expiresAtMs<=Date.now())throw st("process_authority_lost");let c=Sd(e.claim);if(c.executing)throw st("process_busy");if(c.executing=!0,c.cancelRequested)return c.phase="settling",la(e.claim.operation_id);c.phase="starting";let l=e.journals??vd();md(l.directory,{recursive:!0,mode:448});let m=rr({runtimeDirectory:Bo(l.directory),previousRuntimeDirectories:(l.previous??[]).filter((K)=>ca(K)).map((K)=>Bo(K)),root:e.root,runId:JSON.stringify([e.claim.owner,e.claim.run_id,e.claim.root_id,e.claim.operation_id]),maxScopes:ua});try{for(let K of[e.root,e.cwd])if(!Ne(Bo(K),m.journalDirectory))throw new r("process_journal_inside_workspace","The selected root contains the private process journal. Select an existing narrower granted workspace root outside the journal; no command was dispatched.")}catch(K){throw m.disposeSocket(),K}let f=pd(m.journalDirectory),g=e.claim.capability===wd,w=()=>bd.set(e.claim.operation_id,{path:m.journalDirectory,ino:f.ino,dev:f.dev,anyCompletion:g}),x=m.launchDirectory,C=_t(x,"config.json"),R={url:"",transport:"local_job_ipc",directShell:{mode:e.mode,executable:e.shell,jobId:e.claim.operation_id},workerVersion:D,protocolVersion:2,workerArtifactSha256:S,workerEntrypoint:O,targetGeneration:1,fenceId:$o(),...process.platform==="win32"?{bashExecutable:se()}:{},workRoot:e.root,workspaceAliasPath:e.root,repoPath:e.cwd,jobEnvPath:_t(x,"unused.env"),replSocketPath:_t(x,"unused.sock"),readyPath:_t(x,"ready.json"),directTerminalReceiptPath:_t(x,"terminal.json"),launchId:$o(),expiresAtMs:e.expiresAtMs+5000,bashTimeoutMs:60000,replTimeoutMs:1000,allowedTools:["bash"],managedJobs:{journalDirectory:m.journalDirectory,scopeId:m.scopeId},jobControlSocketPath:m.socketPath,...e.prefix?{bashCommandPrefix:e.prefix}:{},...e.jobsUser?{jobsUser:e.jobsUser}:{}},v;try{hd(C,JSON.stringify(R),{mode:384});let K=sn({configPath:C,root:e.cwd,grantedRoot:e.root,workRoot:e.root,temporaryDirectory:x});v=e.spawnWorker?.(C,R)??ud(K.command,K.args,{...K.options,env:e.environment,stdio:[an,"ignore","ignore"]})}catch(K){throw m.disposeSocket(),K}let I=!1,L=new Promise((K,re)=>{v.once("exit",(ee)=>{I=!0,K(ee)}),v.once("error",(ee)=>{I=!0,re(ee)})});L.catch(()=>{});let N={root:e.root,runId:e.claim.run_id,scopeId:m.scopeId,socketPath:m.socketPath,generation:1,fenceId:R.fenceId,executorLaunchId:R.launchId,expiresAtMs:R.expiresAtMs},M=async(K)=>{let re=await nr(N,{type:"job",version:2,generation:1,id:$o(),jobId:e.claim.operation_id,...K==="start"?{action:K,input:{script:e.command,leaseExpiresAtMs:e.expiresAtMs}}:K==="inspect"?{action:K,input:{after:0}}:K==="probe"?{action:"inspect",input:{after:Number.MAX_SAFE_INTEGER}}:{action:K,input:{}}},new AbortController().signal);if(!re.ok)throw st(re.error);return re.job},U=!1,F=!1,B,V=()=>{U=!0,Ze(v,"SIGTERM")};e.signal.addEventListener("abort",V,{once:!0});let z,Y=0,be=async(K)=>{let re=[...K.output],ee={version:1,process_id:e.claim.operation_id,state:K.state,exit_code:K.exitCode,first_cursor:K.firstCursor,next_cursor:K.nextCursor,truncated:K.truncated,output:re,observed_at:new Date().toISOString()};while(Buffer.byteLength(JSON.stringify(ee))>90000&&re.length)re.shift(),ee.truncated=!0,ee.first_cursor=re[0]?.cursor??ee.next_cursor+1;z=Ar.parse(ee),await e.emit(z),Y=Date.now()};try{let K=Math.min(Date.now()+1e4,e.expiresAtMs);while(!ca(R.readyPath)){if(I)throw new r("process_start_failed","The managed process supervisor exited before accepting a command; no command was dispatched.");if(e.signal.aborted||Date.now()>=K)throw st("process_start_unconfirmed");await da(25)}let re=JSON.parse(fd(R.readyPath,"utf8"));if(re.launchId!==R.launchId||re.fenceId!==R.fenceId||re.workerArtifactSha256!==S)throw st();if(e.signal.throwIfAborted(),c.cancelRequested)return la(e.claim.operation_id);let ee;try{F=!0,ee=await M("start")}catch(Ue){if(!(Ue instanceof r)||Ue.code!=="hands_job_result_unknown")throw Ue;ee=await M("inspect")}if(c.phase="running",c.cancel=async()=>{await M("cancel")},g&&e.preview)c.tunnels=aa({claim:e.claim,executorLaunchId:R.launchId,expiresAtMs:e.expiresAtMs,deniedPorts:e.preview.deniedPorts,inspect:async()=>c.phase==="running"&&!I?await M("probe"):null});if(c.cancelRequested)await c.cancel(),ee=await M("inspect");for(;;){if(!["starting","running"].includes(ee.state))c.phase="settling",c.cancel=void 0;if(!z||z.state!==ee.state||z.next_cursor!==ee.nextCursor&&Date.now()-Y>=5000)await be(ee);if(!["starting","running"].includes(ee.state))break;if(e.signal.aborted||I)throw st();await da(1000);try{ee=await M("inspect"),B=void 0}catch(Ue){if(!(Ue instanceof r)||Ue.code!=="hands_job_result_unknown"||e.signal.aborted||I||Date.now()-(B??=Date.now())>120000)throw Ue}}if(!z||z.state==="uncertain")throw st();return z}finally{if(c.phase="settling",c.cancel=void 0,c.tunnels?.dispose(),c.tunnels=void 0,await c.cancelInFlight?.catch(()=>{}),e.signal.removeEventListener("abort",V),!I&&!U)Ze(v,"SIGTERM");let K,re=await Promise.race([L.then((ee)=>({code:ee})),new Promise((ee)=>{K=setTimeout(()=>ee(null),6000)})]).finally(()=>{clearTimeout(K)});if(!re){try{Ze(v,"SIGKILL")}catch{}try{await L}finally{if(I)m.disposeSocket()}throw st("process_cleanup_unconfirmed")}try{if((U||e.signal.aborted)&&re.code===0&&F){b(x);let ee=JSON.parse(h(R.directTerminalReceiptPath)),Ue=Do.safeParse(ee.observation);if(Object.keys(ee).length===4&&ee.launch_id===R.launchId&&ee.fence_id===R.fenceId&&ee.scope_id===m.scopeId&&Ue.success&&Ue.data.process_id===e.claim.operation_id){if(g)w();throw new Lr(Ue.data)}}}catch(ee){if(ee instanceof Lr)throw ee}finally{if(I)m.disposeSocket()}if(re.code!==0&&!U&&F)throw st("process_cleanup_unconfirmed");if(!U&&re.code===0&&(z&&["exited","cancelled","expired"].includes(z.state)||!F&&c.cancelRequested)||g&&re.code===0&&!F)w()}}import{createServer as Rd,request as Ed}from"http";import{connect as Pd,isIP as Cd}from"net";var ha=120000,Od=15000;function Id(e,c,l){let m=ar(c).toLowerCase().replace(/\.$/,"");if(!m||Cd(m))return!1;return e.some((f)=>{if(!Mo.test(f))return!1;let g=f.lastIndexOf(":"),w=g>0?f.slice(0,g):f;if(g>0&&Number(f.slice(g+1))!==l)return!1;return w.startsWith("*.")?m.endsWith(w.slice(1)):m===w})}function Ad(e,c){let l=/^\[?([^\]]+?)\]?:([0-9]{1,5})$/.exec(e),m=l?l[1]:e,f=l?Number(l[2]):c;return m&&f>=1&&f<=65535?{host:m,port:f}:null}async function Ho(e,c,l){if(!Id(l,e,c))return null;let m=await Di(e);return m.ok?m.addresses[0]:null}function kr(e,c){e.end(`HTTP/1.1 ${c} ${c===403?"Forbidden":"Bad Gateway"}\r
-Connection: close\r
-Content-Length: 0\r
-\r
-`)}function pa(e,c){return new Promise((l,m)=>{let f=Pd({host:e,port:c}),g=setTimeout(()=>f.destroy(Error("connect_timeout")),Od);f.once("connect",()=>{clearTimeout(g),l(f)}),f.once("error",(w)=>{clearTimeout(g),m(w)})})}function ma(e,c,l){for(let m of[e,c])m.on("error",()=>{e.destroy(),c.destroy()}),m.on("close",()=>{e.destroy(),c.destroy()});if(c.setTimeout(ha,()=>c.destroy()),l.length)c.write(l);e.pipe(c).pipe(e)}function fa(e,c){let l={...e,host:c};return delete l["proxy-authorization"],delete l["proxy-connection"],l}async function ga(e,c=()=>{}){let l=[...e],m=new Set,f=(x)=>{m.add(x),x.once("close",()=>m.delete(x))},g=Rd((x,C)=>{(async()=>{let R;try{R=new URL(x.url??"")}catch{R=new URL("invalid:")}let v=Number(R.port||80),I=R.protocol==="http:"?await Ho(R.hostname,v,l):null;if(!I){c(),C.writeHead(403,{connection:"close"}).end();return}let L=Ed({host:I,port:v,method:x.method,path:`${R.pathname}${R.search}`,headers:fa(x.headers,R.host),agent:!1,timeout:ha},(N)=>{C.writeHead(N.statusCode??502,N.headers),N.pipe(C)});L.on("timeout",()=>L.destroy()),L.on("error",()=>{if(!C.headersSent)C.writeHead(502);C.end()}),C.on("close",()=>L.destroy()),x.pipe(L)})().catch(()=>{if(!C.headersSent)C.writeHead(502);C.end()})});g.on("connection",f),g.on("connect",(x,C,R)=>{f(C),C.on("error",()=>C.destroy()),(async()=>{let v=Ad(x.url??"",443),I=v?await Ho(v.host,v.port,l):null;if(!v||!I){c(),kr(C,403);return}let L=await pa(I,v.port).catch(()=>null);if(!L){kr(C,502);return}if(C.destroyed){L.destroy();return}f(L),C.write(`HTTP/1.1 200 Connection Established\r
-\r
-`),ma(C,L,R)})().catch(()=>C.destroy())}),g.on("upgrade",(x,C,R)=>{f(C),C.on("error",()=>C.destroy()),(async()=>{let v;try{v=new URL(x.url??"")}catch{kr(C,403);return}let I=Number(v.port||80),L=["http:","ws:"].includes(v.protocol)?await Ho(v.hostname,I,l):null;if(!L){c(),kr(C,403);return}let N=await pa(L,I).catch(()=>null);if(!N){kr(C,502);return}f(N);let M=fa(x.headers,v.host),U=[`${x.method} ${v.pathname}${v.search} HTTP/1.1`];for(let[F,B]of Object.entries(M))for(let V of Array.isArray(B)?B:B===void 0?[]:[B])U.push(`${F}: ${V}`);N.write(`${U.join(`\r
-`)}\r
-\r
-`),ma(C,N,R)})().catch(()=>C.destroy())}),await new Promise((x,C)=>{g.once("error",C),g.listen(0,"127.0.0.1",()=>x())});let{port:w}=g.address();return{url:`http://127.0.0.1:${w}`,close(){g.close();for(let x of m)x.destroy()}}}import{createHash as Jo,randomUUID as Dd}from"crypto";import{closeSync as In,constants as Qe,fchownSync as Nd,fstatSync as Ot,fsyncSync as Md,linkSync as Oa,lstatSync as zo,mkdirSync as Ia,openSync as Cn,readSync as ka,realpathSync as Ko,unlinkSync as Aa,writeSync as $d}from"fs";import{isAbsolute as Bd,join as Fd,relative as Ud,sep as Hd}from"path";import{platform as Yo}from"os";import{getSystemErrorName as jd}from"util";var _a={type:"string",format:"uuid"},Sa=String.raw`^(?![\\/])(?![A-Za-z]:[\\/])(?!.*(?:^|[\\/])\.\.(?:[\\/]|$))(?!.*\u0000)(?=.*\S)[\s\S]+$`,xn={type:"string",minLength:1,maxLength:4096,pattern:Sa},jo=t().min(1).max(4096).regex(new RegExp(Sa)),Rn={device_id:t().uuid(),root_id:t().uuid(),timeout_ms:o().int().min(1000).max(60000).optional()},En={device_id:_a,root_id:_a,timeout_ms:{type:"integer",minimum:1000,maximum:60000}},Dh={read:{schema:i({...Rn,path:jo,offset:o().int().min(0).optional(),max_bytes:o().int().min(1).max(131072).optional()}).strict(),inputSchema:{type:"object",required:["device_id","root_id","path"],properties:{...En,path:xn,offset:{type:"integer",minimum:0},max_bytes:{type:"integer",minimum:1,maximum:131072}},additionalProperties:!1}},write:{schema:i({...Rn,path:jo,content:t().max(131072),mode:s(["overwrite","append"]).optional(),create_parents:d().optional()}).strict(),inputSchema:{type:"object",required:["device_id","root_id","path","content"],properties:{...En,path:xn,content:{type:"string",maxLength:131072},mode:{type:"string",enum:["overwrite","append"]},create_parents:{type:"boolean"}},additionalProperties:!1}},exec:{schema:i({...Rn,command:t().min(1).max(16000),cwd:jo.optional(),mode:s(["confined","host"]).optional()}).strict(),inputSchema:{type:"object",required:["device_id","root_id","command"],properties:{...En,command:{type:"string",minLength:1,maxLength:16000},cwd:xn,mode:{type:"string",enum:["confined","host"],description:"Defaults to host: the existing permitted login shell with OS/account access, requiring execute and environment-discovery permission. Request confined explicitly for a scrubbed shell without network."}},additionalProperties:!1}}},ft=1073741824,Tr=600000,ya=String.raw`(?!\.{1,2}(?:/|(?![\s\S])))[^/\\\u0000]+`,va=String.raw`^(?![A-Za-z]:/)(?=[\s\S]*\S)${ya}(?:/${ya})*(?![\s\S])`,xa=new RegExp(va);function Ra(e){return typeof e==="string"&&e.length>0&&e.length<=4096&&xa.test(e)}var Wo=t().min(1).max(4096).regex(xa),qo={...xn,pattern:va},Ea=t().regex(/^[a-f0-9]{64}$/),Pa=i({kind:n("workspace"),path:Wo}).strict(),Ld=_("kind",[Pa,i({kind:n("attachment"),attachment_id:t().min(1).max(120),sha256:Ea}).strict()]),Pn=1,Dr="cloud_workspace_id",Vo="cloud_workspace",Go=1,kd=_("kind",[Pa,i({kind:n("attachment"),download_url:t().min(1).max(16384),size_bytes:o().int().min(0).max(ft),sha256:Ea}).strict()]),Ca=i({source_version:n(Pn),source:kd,url:t().min(1).max(16384),transfer_cloud_scope:i({sandboxId:t().min(1).max(256),revision:o().int().nonnegative(),brainFence:t().uuid()}).strict().optional(),[Dr]:t().min(1).max(160).optional()}).strict(),Nh=i({ready:n(!0),cloud_source_version:n(Pn),source_kinds:u(s(["workspace","attachment"]))});var ba=i({...Rn,timeout_ms:o().int().min(1000).max(Tr).optional(),source_path:Wo,destination_path:Wo,idempotency_key:t().min(1).max(160).regex(/^[A-Za-z0-9._:-]+$/).optional()}).strict(),wa={type:"object",required:["device_id","root_id","source_path","destination_path"],properties:{...En,timeout_ms:{type:"integer",minimum:1000,maximum:Tr},source_path:qo,destination_path:qo,idempotency_key:{type:"string",minLength:1,maxLength:160,pattern:"^[A-Za-z0-9._:-]+$"}},additionalProperties:!1},Td={oneOf:[{type:"object",required:["kind","path"],properties:{kind:{type:"string",const:"workspace"},path:qo},additionalProperties:!1},{type:"object",required:["kind","attachment_id","sha256"],properties:{kind:{type:"string",const:"attachment"},attachment_id:{type:"string",minLength:1,maxLength:120},sha256:{type:"string",pattern:"^[a-f0-9]{64}$"}},additionalProperties:!1}]},Mh=Q([ba,ba.omit({source_path:!0}).extend({source:Ld}).strict()]),$h={...wa,required:["device_id","root_id","destination_path"],properties:{...wa.properties,source:Td},oneOf:[{required:["source_path"],not:{required:["source"]}},{required:["source"],not:{required:["source_path"]}}]};var Zo=65536;function Fe(e){throw new r(e,e)}function An(e){return typeof e==="object"&&e!==null&&"code"in e&&typeof e.code==="string"?e.code:void 0}function On(e,c,l){if(c.throwIfAborted(),e instanceof r||e instanceof Error&&e.name==="AbortError")throw e;return Fe(l)}function Wd(e,c,l){let m;switch(An(e)){case"ENOENT":m=l==="export"?"transfer_source_missing":"transfer_path_unavailable";break;case"EACCES":case"EPERM":case"EROFS":m="transfer_permission_denied";break;case"ELOOP":case"ENOTDIR":m="transfer_path_unsafe";break;case"EEXIST":m="transfer_destination_exists";break;default:m="transfer_path_unavailable"}return On(e,c,m)}function qd(e){if(typeof e!=="string"||e.length>16384)return Fe("transfer_url_invalid");let c;try{c=new URL(e)}catch{return Fe("transfer_url_invalid")}if(c.protocol!=="https:"||c.username||c.password||c.hash)return Fe("transfer_url_invalid");return c.href}var Xo=Qe.O_RDONLY|Qe.O_DIRECTORY|Qe.O_NOFOLLOW;async function Vd(){if(Yo()==="win32"){let R=new Map,v,I=-1,L=()=>Object.assign(Error("transfer_path_unsafe"),{code:"ELOOP"}),N=(B)=>{let V=Ud(v,B);return V===""||V!==".."&&!V.startsWith(`..${Hd}`)&&!Bd(V)},M=(B)=>{let V=zo(B);if(V.isSymbolicLink())throw L();if(!V.isDirectory())throw Object.assign(Error("transfer_path_unsafe"),{code:"ENOTDIR"});let z=Ko(B);if(v??=z,!N(z))throw L();return R.set(I,{path:B,real:z}),I--},U=(B)=>{let V=R.get(B);if(Ko(V.path)!==V.real)throw L();return V.path},F=(B,V)=>{if(Zr(V))throw Object.assign(Error("transfer_path_invalid"),{code:"ENOTDIR"});return Fd(R.get(B).path,V)};return{root:M,openDirectory:(B,V)=>M(F(B,V)),open:(B,V,z,Y=384)=>{let be=F(B,V);if(zo(be,{throwIfNoEntry:!1})?.isSymbolicLink())throw L();U(B);let K=Cn(be,z,Y);try{let re=Ot(K),ee=zo(be);if(ee.isSymbolicLink()||re.ino!==ee.ino||re.dev!==ee.dev||!N(Ko(be)))throw L()}catch(re){throw In(K),re}return K},mkdir:(B,V)=>{let z=F(B,V);U(B),Ia(z)},link:(B,V,z)=>{let Y=F(B,V),be=F(B,z);U(B),Oa(Y,be)},unlink:(B,V)=>Aa(F(B,V)),closeDirectory:(B)=>{R.delete(B)},inherit:()=>{},close:()=>{}}}let e={root:(R)=>Cn(R,Xo),closeDirectory:In,inherit:Gd};if(Yo()==="linux")return{...e,openDirectory:(R,v)=>Cn(`/proc/self/fd/${R}/${v}`,Xo),open:(R,v,I,L=384)=>Cn(`/proc/self/fd/${R}/${v}`,I,L),mkdir:(R,v)=>Ia(`/proc/self/fd/${R}/${v}`,{mode:448}),link:(R,v,I)=>Oa(`/proc/self/fd/${R}/${v}`,`/proc/self/fd/${R}/${I}`),unlink:(R,v)=>Aa(`/proc/self/fd/${R}/${v}`),close:()=>{}};if(Yo()!=="darwin")return Fe("transfer_platform_unsupported");let{dlopen:c,FFIType:l,ptr:m,read:f}=await import("bun:ffi"),g=c("/usr/lib/libSystem.B.dylib",{__error:{args:[],returns:l.ptr},openat:{args:[l.i32,l.ptr,l.i32,l.i32,l.i32,l.i32,l.i32,l.i32,l.i32],returns:l.i32},mkdirat:{args:[l.i32,l.ptr,l.i32],returns:l.i32},linkat:{args:[l.i32,l.ptr,l.i32,l.ptr,l.i32],returns:l.i32},unlinkat:{args:[l.i32,l.ptr,l.i32],returns:l.i32}}),w=g.symbols.__error();if(w===null)return g.close(),Fe("transfer_path_unavailable");let x=(R)=>{if(R<0){let v=jd(-f.i32(w));throw Object.assign(Error("transfer_path_unavailable"),{code:v})}return R},C=(R,v,I,L=384)=>x(g.symbols.openat(R,m(Buffer.from(`${v}\x00`)),I,L,0,0,0,0,L));return{...e,openDirectory:(R,v)=>C(R,v,Xo),open:C,mkdir:(R,v)=>{x(g.symbols.mkdirat(R,m(Buffer.from(`${v}\x00`)),448))},link:(R,v,I)=>{x(g.symbols.linkat(R,m(Buffer.from(`${v}\x00`)),R,m(Buffer.from(`${I}\x00`)),0))},unlink:(R,v)=>{x(g.symbols.unlinkat(R,m(Buffer.from(`${v}\x00`)),0))},close:()=>g.close()}}function Gd(e,c){let l=Ot(e),m=Ot(c);if(m.uid!==l.uid||m.gid!==l.gid)Nd(c,l.uid,l.gid)}function zd(e,c,l,m){if(!Ra(l))return Fe("transfer_path_invalid");let f=l.split("/"),g=e.root(c);try{for(let w of f.slice(0,-1)){let x;try{x=e.openDirectory(g,w)}catch(C){if(!m||An(C)!=="ENOENT")throw C;try{e.mkdir(g,w)}catch(R){if(An(R)!=="EEXIST")throw R}x=e.openDirectory(g,w),e.inherit(g,x)}e.closeDirectory(g),g=x}return{fd:g,leaf:f.at(-1)}}catch(w){throw e.closeDirectory(g),w}}function La(e,c){let l=Ot(e,{bigint:!0});if(!l.isFile()||l.size>ft)return Fe("transfer_file_invalid");let m=Jo("sha256"),f=Buffer.alloc(Zo),g=0;while(!0){c.throwIfAborted();let x=ka(e,f,0,f.length,g);if(!x)break;if(g+=x,g>ft)return Fe("transfer_size_exceeded");m.update(f.subarray(0,x))}let w=Ot(e,{bigint:!0});if(BigInt(g)!==l.size||w.size!==l.size||w.mtimeNs!==l.mtimeNs||w.ctimeNs!==l.ctimeNs)return Fe("transfer_source_changed");return{size_bytes:g,sha256:m.digest("hex")}}async function Wt(e){e.signal.throwIfAborted();try{let c=qd(e.payload.url),l=await Vd(),m,f,g;try{if(m=zd(l,e.root,e.path,e.direction==="import"),e.direction==="export"){f=l.open(m.fd,m.leaf,Qe.O_RDONLY|Qe.O_NOFOLLOW|Qe.O_NONBLOCK);let L=Ot(f,{bigint:!0});if(!L.isFile()||L.size>ft)return Fe("transfer_file_invalid");let N=Jo("sha256"),M=0,U=f,F,B=new ReadableStream({pull(be){try{e.signal.throwIfAborted();let K=Buffer.alloc(Zo),re=ka(U,K,0,K.length,M);if(!re){be.close();return}if(M+=re,M>L.size)return Fe("transfer_source_changed");N.update(K.subarray(0,re)),be.enqueue(K.subarray(0,re))}catch(K){throw F=K,K}}});try{let be=await(e.fetchImpl??fetch)(c,Object.assign({method:"PUT",body:B,redirect:"error",signal:e.signal,headers:{"content-type":"application/octet-stream","content-length":String(L.size)}},{duplex:"half"}));if(F!==void 0)throw F;if(!be.ok)return Fe("transfer_upload_failed");await be.body?.cancel()}catch(be){if(F!==void 0)throw F;return On(be,e.signal,"transfer_upload_failed")}let V=Ot(f,{bigint:!0});if(BigInt(M)!==L.size||V.size!==L.size||V.mtimeNs!==L.mtimeNs||V.ctimeNs!==L.ctimeNs)return Fe("transfer_source_changed");let z=N.digest("hex"),Y=La(f,e.signal);if(Y.size_bytes!==M||Y.sha256!==z)return Fe("transfer_source_changed");return{size_bytes:M,sha256:z,outcome:"copied"}}let w=e.payload.size_bytes,x=e.payload.sha256;if(typeof w!=="number"||!Number.isSafeInteger(w)||w<0||w>ft||typeof x!=="string"||!/^[a-f0-9]{64}$/.test(x))return Fe("transfer_receipt_invalid");let C;try{C=l.open(m.fd,m.leaf,Qe.O_RDONLY|Qe.O_NOFOLLOW|Qe.O_NONBLOCK)}catch(L){if(An(L)!=="ENOENT")throw L}if(C!==void 0){try{let L=La(C,e.signal);if(L.size_bytes===w&&L.sha256===x)return{...L,outcome:"already_present"}}finally{In(C)}return Fe("transfer_destination_exists")}g=`.reason-copy-${Dd()}`,f=l.open(m.fd,g,Qe.O_CREAT|Qe.O_EXCL|Qe.O_WRONLY|Qe.O_NOFOLLOW,384),l.inherit(m.fd,f);let R;try{let L=await(e.fetchImpl??fetch)(c,{redirect:"error",signal:e.signal});if(!L.ok||!L.body)return Fe("transfer_download_failed");R=L.body.getReader()}catch(L){return On(L,e.signal,"transfer_download_failed")}let v=Jo("sha256"),I=0;try{while(!0){e.signal.throwIfAborted();let L=await R.read().catch((N)=>On(N,e.signal,"transfer_download_failed"));if(L.done)break;if(I+=L.value.length,I>w)return Fe("transfer_size_mismatch");v.update(L.value);for(let N=0;N<L.value.length;)e.signal.throwIfAborted(),N+=$d(f,L.value,N,Math.min(Zo,L.value.length-N))}}finally{await R.cancel().catch(()=>{})}if(I!==w||v.digest("hex")!==x)return Fe("transfer_hash_mismatch");return Md(f),await e.beforeCommit?.(),e.signal.throwIfAborted(),l.link(m.fd,g,m.leaf),{size_bytes:w,sha256:x,outcome:"copied"}}finally{try{if(f!==void 0)In(f)}finally{try{if(m){if(g)try{l.unlink(m.fd,g)}catch{}l.closeDirectory(m.fd)}}finally{l.close()}}}}catch(c){return Wd(c,e.signal,e.direction)}}import{spawn as Yd}from"child_process";import{mkdtempSync as Xd,rmSync as Jd,writeFileSync as Zd}from"fs";import{constants as Qd,platform as eu,tmpdir as tu}from"os";import{join as Ma}from"path";import{gunzipSync as Kd,gzipSync as Yh}from"zlib";var Da=900000,Jh=Da+60000,Nr=49152,Ta=(e)=>t().min(1).max(e).regex(/^[A-Za-z0-9+/]+=*$/),Na=i({version:n(1),script_gzip:Ta(163840),stdin_gzip:Ta(65536),cwd:t().min(1).max(4096).startsWith("/"),env:oe(t().regex(/^[A-Z_][A-Z0-9_]{0,63}$/),t().max(4096)).refine((e)=>Object.keys(e).length<=16,"too many variables"),timeout_ms:o().int().min(1000).max(Da)}).strict(),Qo=t().max(Nr+256),Zh=i({exit_code:o().int().min(0).max(255),stdout:Qo,stderr:Qo,combined:Qo.optional()}).strict();function di(e){return Kd(Buffer.from(e,"base64")).toString("utf8")}var ru="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",nu=["RUSTUP_HOME","TZ","LC_ALL"],ou=2000,iu=100;function mi(){return eu()==="linux"&&process.geteuid?.()===0}function pi(e){let c=Math.floor(e/2),l=[],m=0,f=Buffer.alloc(0),g=0;return{push(w){g+=w.length;let x=w;if(m<c){let C=x.subarray(0,c-m);l.push(C),m+=C.length,x=x.subarray(C.length)}if(x.length)f=Buffer.concat([f,x]).subarray(-c)},text(){let w=g-m-f.length;return Buffer.concat(l).toString("utf8")+(w>0?`
-[reason: ${w} bytes of output omitted]
-`:"")+f.toString("utf8")}}}async function $a(e,c){if(!mi())throw new r("workspace_setup_requires_root","Workspace setup runs only on a root Linux worker.");let l=Na.safeParse(e);if(!l.success)throw new r("invalid_request","Reason sent an invalid workspace setup.");let m=l.data,f,g;try{f=di(m.script_gzip),g=di(m.stdin_gzip)}catch{throw new r("invalid_request","Reason sent an unreadable workspace setup.")}c.throwIfAborted();let w=Xd(Ma(tu(),"reason-workspace-setup-"));try{let x=Ma(w,"setup.sh");Zd(x,f,{mode:384});let C={PATH:ru,LANG:"C.UTF-8",HOME:"/root",USER:"root",LOGNAME:"root",SHELL:"/bin/bash",TMPDIR:"/tmp"};for(let Y of nu)if(process.env[Y])C[Y]=process.env[Y];Object.assign(C,m.env);let R=Yd("/bin/bash",[x],{cwd:m.cwd,env:C,detached:!0,stdio:["pipe","pipe","pipe"]}),v=pi(Nr),I=pi(Nr),L=pi(Nr);R.stdout.on("data",(Y)=>{v.push(Y),L.push(Y)}),R.stderr.on("data",(Y)=>{I.push(Y),L.push(Y)}),R.stdin.on("error",()=>{}),R.stdin.end(g);let N=(Y)=>{try{if(R.pid)process.kill(-R.pid,Y)}catch{}},M=!1,U,F=()=>{N("SIGTERM"),U??=setTimeout(()=>N("SIGKILL"),ou)},B=setTimeout(()=>{M=!0,F()},m.timeout_ms);c.addEventListener("abort",F,{once:!0});let V=await new Promise((Y,be)=>{R.once("error",()=>be(new r("workspace_setup_start_failed","The workspace setup did not start."))),R.once("exit",(K,re)=>Y({code:K,signal:re}))}).finally(()=>{clearTimeout(B),clearTimeout(U),c.removeEventListener("abort",F)});await new Promise((Y)=>{let be=setTimeout(Y,iu);R.once("close",()=>{clearTimeout(be),Y()})}),R.stdout.destroy(),R.stderr.destroy(),c.throwIfAborted();let z=M?124:V.signal?128+(Qd.signals[V.signal]??0):V.code??1;return{exit_code:Math.min(255,z),stdout:v.text(),stderr:I.text(),...z!==0?{combined:L.text()}:{}}}finally{Jd(w,{recursive:!0,force:!0})}}import{chmodSync as su,mkdtempSync as au,realpathSync as Ba,rmSync as cu}from"fs";import{tmpdir as lu}from"os";import{dirname as du,join as hi,sep as uu}from"path";function gi(e){return dr(e,cr(e)!==null).repoPath}function Fa(e,c){let l;try{if(typeof c!=="string")throw Error("invalid");l=[J,void 0].map((f)=>du(T({kind:"managed",workspaceId:c,...f?{layout:f}:{}})))}catch{throw new r("cloud_copy_workspace_invalid","The Cloud copy workspace is invalid.")}let m;for(let f of l)try{m=Ba(hi(e,f));break}catch{}if(m===void 0)throw new r("cloud_copy_workspace_unavailable","The Session workspace is not on this computer.");if(!m.startsWith(`${e}${uu}`))throw new r("cloud_copy_workspace_invalid","The Cloud copy workspace is outside this worker's root.");return m}async function Ua(e){e.signal.throwIfAborted();let c=e.source;if(c.kind==="workspace"){let m=gi(e.runtimeRoot);if(E(m)||E(hi(m,c.path)))throw new r("protected_path","Credential and secret paths are unavailable to local tasks.");return Wt({direction:"export",root:m,path:c.path,payload:{url:e.url},signal:e.signal,fetchImpl:e.fetchImpl})}let l=au(hi(lu(),`reason-cloud-copy-${process.pid}-`));try{su(l,448);let m=Ba(l);await Wt({direction:"import",root:m,path:"source",payload:{url:c.download_url,size_bytes:c.size_bytes,sha256:c.sha256},signal:e.signal,fetchImpl:e.fetchImpl});let f=await Wt({direction:"export",root:m,path:"source",payload:{url:e.url},signal:e.signal,fetchImpl:e.fetchImpl});if(f.size_bytes!==c.size_bytes||f.sha256!==c.sha256)throw new r("transfer_source_changed","The verified attachment changed before export.");return f}finally{cu(l,{recursive:!0,force:!0})}}import{constants as rt}from"fs";import{closeSync as cl,existsSync as ut,fstatSync as ll,ftruncateSync as Im,lstatSync as Ps,mkdirSync as Am,mkdtempSync as Lm,openSync as dl,readSync as km,realpathSync as at,rmSync as Tm,statSync as Jr,writeSync as Dm}from"fs";import{homedir as qr,platform as le,tmpdir as Nm}from"os";import{dirname as zr,isAbsolute as Mm,join as ul,relative as Cs,resolve as $m,sep as Bm}from"path";import{spawn as Fm}from"child_process";var yg=Vr+15000;var Ha=["fs.read","fs.write","fs.export","fs.import","exec.run","exec.full","process.run.v1","process.full.v1","preview.serve.v1","pty.start","git.run","process.list","ports.list","computer.use","browser.use","browser.recording.v1","browser.pr-proof.v1","hands.connect","jobs.control","environment.install","github.local.v1","inference.custom.v1","display.stream.v1","automation.call.v1","simulator.call.v1","simulator.stream.v1","tunnel.open","tunnel.close","workspace.setup.v1"];var mu=new Set(["process.run.v1","process.full.v1","computer.use","browser.use"]),Mr=new Set(["jobs.control","environment.install","tunnel.open","tunnel.close","display.stream.v1","automation.call.v1","workspace.setup.v1","simulator.call.v1","simulator.stream.v1"]);function Ln(e,c){if(mu.has(e))return!1;if(Mr.has(e)&&!c.runtimeDirectory)return!1;if((e==="inference.custom.v1"||e==="preview.serve.v1"||e==="simulator.call.v1"||e==="simulator.stream.v1")&&(c.executionMode!=="unsandboxed"||!c.runtimeDirectory))return!1;if(c.executionMode!=="unsandboxed"&&(["exec.full","hands.connect","pty.start","browser.pr-proof.v1"].includes(e)||Mr.has(e)))return!1;return!0}import{accessSync as fu,constants as hu,existsSync as gu,statSync as _u}from"fs";import{basename as yu,isAbsolute as bu}from"path";var $r=["-lic"],ja="/bin/zsh",wu=new Set(["zsh","bash"]),Wa=20000,_i=60000,Su=65536,vu=64,xu=8192,Ru=new Set(["NODE_OPTIONS","PATH","ZDOTDIR","BASH_ENV","ENV"]),Eu=["DYLD_","LD_"];function Pu(e){let c=e.toUpperCase();return Ru.has(c)||Eu.some((l)=>c.startsWith(l))}function qa(e=process.env){return!0}function Cu(e){if(!bu(e)||e.includes("\x00"))return!1;if(!wu.has(yu(e)))return!1;try{if(!_u(e).isFile())return!1;return fu(e,hu.X_OK),!0}catch{return!1}}function Gt(e=process.env){if(process.platform==="win32")return fe()??ja;let c=e.SHELL?.trim();if(c&&Cu(c))return c;return ja}function yi(e=process.env){return qa(e)&&gu(Gt(e))}function bi(e=process.env){if(!qa(e))throw new r("full_control_disabled","Full-control execution is unavailable on this Reason Device.")}function wi(e){if(typeof e!=="string"||e.length===0||e.includes("\x00")||Buffer.byteLength(e,"utf8")>Su)throw new r("invalid_payload","command is missing or too large.");return e}function Ii(e){if(e===void 0||e===null)return{forwarded:{},ignored:[]};if(typeof e!=="object"||Array.isArray(e))throw new r("invalid_payload","env must be an object of strings.");let c=Object.entries(e);if(c.length>vu)throw new r("invalid_payload","env has too many entries.");let l={},m=[];for(let[f,g]of c){if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(f)||typeof g!=="string"||g.includes("\x00")||Buffer.byteLength(g,"utf8")>xu)throw new r("invalid_payload","env entry is invalid or too large.");if(Pu(f)){m.push(f);continue}l[f]=g}return{forwarded:l,ignored:m}}async function Va(e){let c=e.processEnv??process.env;if(bi(c),e.signal.aborted)throw new r("cancelled","Operation was cancelled.");let l=wi(e.command),m=Gt(c),{forwarded:f,ignored:g}=Ii(e.requestEnv),w=await e.spawn(m,[...$r,l],{cwd:e.cwd,timeoutMs:e.timeoutMs,signal:e.signal,env:{...c,...f}});return{exit_code:w.exitCode,signal:w.signal,stdout:w.stdout,stderr:w.stderr,timed_out:w.timedOut,truncated:w.truncated,shell:m,shell_flags:[...$r],login:!0,interactive:!0,sandbox:"none",ignored_env:g}}function Ga(e=process.env){return{transport:"shell",shell:`${Gt(e)} ${$r.join(" ")}`,login_shell:!0,interactive_shell:!0,rc_files_loaded:!0,sandbox:"none",network:!0,environment:"inherited",privilege:"user",sudo:"argv_exact_nopasswd_only",activation:"explicit_device_grant",max_timeout_ms:_i}}import{readFile as Ou,readdir as Iu,readlink as Au,realpath as Lu}from"fs/promises";import{basename as ku,relative as Tu,sep as Du}from"path";var It="/proc",Nu=250,za=500,Mu=50,$u=250,Bu=1024,Ka=4096,Fu=1,Uu=3,Ya=9,Hu="0A",ju=/^socket:\[(\d+)\]$/,Li={readDirectory:(e)=>Iu(e),readLink:(e)=>Au(e),readTextFile:(e)=>Ou(e,"utf8"),realPath:(e)=>Lu(e)};function Ja(e,c){return c===e||c.startsWith(`${e}${Du}`)}function Wu(e,c){return Tu(e,c)||"."}async function Za(e){let c;try{c=await e.readDirectory(It)}catch{return[]}return c.filter((l)=>/^[0-9]+$/.test(l)).map((l)=>Number(l)).filter((l)=>Number.isSafeInteger(l)&&l>0).sort((l,m)=>l-m)}async function Qa(e,c){try{let m=(await c.readTextFile(`${It}/${e}/comm`)).slice(0,Ka).split(`
-`,1)[0]?.trim();if(m)return m}catch{}try{let m=(await c.readTextFile(`${It}/${e}/cmdline`)).slice(0,Ka).split("\x00",1)[0]?.trim();return m?ku(m):null}catch{return null}}async function ec(e,c=Li){let l;try{l=await c.readLink(`${It}/${e}/cwd`)}catch{return null}if(!l)return null;try{return await c.realPath(l)}catch{return null}}async function tc(e,c=Li){let l=[];for(let m of await Za(c)){if(l.length>=Nu)break;let f=await ec(m,c);if(!f||!Ja(e,f))continue;l.push({pid:m,command:await Qa(m,c),cwd:Wu(e,f)})}return{processes:l}}function Xa(e){let c=[];for(let l=0;l<8;l+=2)c.unshift(Number.parseInt(e.slice(l,l+2),16));return c}function qu(e){let c=[];for(let C=0;C<16;C+=2)c.push(e[C]<<8|e[C+1]);if(c.slice(0,5).every((C)=>C===0)&&c[5]===65535)return`::ffff:${e.slice(12).join(".")}`;let l=-1,m=0,f=-1;for(let C=0;C<=c.length;C+=1){if(C<c.length&&c[C]===0){if(f<0)f=C;continue}if(f>=0){let R=C-f;if(R>m)l=f,m=R;f=-1}}let g=c.map((C)=>C.toString(16));if(m<2)return g.join(":");let w=g.slice(0,l).join(":"),x=g.slice(l+m).join(":");return`${w}::${x}`}function Vu(e,c){if(/^[0-9A-Fa-f]{8}$/.test(e)){let l=Xa(e);if(l.every((m)=>m===0))return`*:${c}`;return`${l.join(".")}:${c}`}if(/^[0-9A-Fa-f]{32}$/.test(e)){let l=[];for(let m=0;m<4;m+=1)l.push(...Xa(e.slice(m*8,m*8+8)));if(l.every((m)=>m===0))return`*:${c}`;return`[${qu(l)}]:${c}`}return null}function Gu(e,c){let l=[];for(let m of e.split(`
-`).slice(1)){if(l.length>=c)break;let f=m.trim().split(/\s+/);if(f.length<=Ya)continue;if(f[Uu]?.toUpperCase()!==Hu)continue;let g=f[Fu]??"",w=g.lastIndexOf(":");if(w<0)continue;let x=Number.parseInt(g.slice(w+1),16);if(!Number.isInteger(x)||x<=0||x>65535)continue;let C=Vu(g.slice(0,w),x),R=f[Ya];if(!C||!R||!/^[0-9]+$/.test(R))continue;l.push({inode:R,port:x,address:C})}return l}async function zu(e){let c=[];for(let l of["tcp","tcp6"]){if(c.length>=za)break;let m;try{m=await e.readTextFile(`${It}/net/${l}`)}catch{continue}c.push(...Gu(m,za-c.length))}return c}async function Ku(e,c){let l=new Map;if(e.size===0)return l;for(let m of await Za(c)){if(l.size>=e.size)break;let f;try{f=await c.readDirectory(`${It}/${m}/fd`)}catch{continue}for(let g of f.slice(0,Bu)){let w;try{w=await c.readLink(`${It}/${m}/fd/${g}`)}catch{continue}let x=w.match(ju)?.[1];if(!x||!e.has(x)||l.has(x))continue;l.set(x,m)}}return l}async function rc(e,c=Li){let l=await zu(c),m=await Ku(new Set(l.map((v)=>v.inode)),c),f=[];for(let v of l){let I=m.get(v.inode);if(I===void 0)continue;f.push({pid:I,port:v.port,address:v.address})}f.sort((v,I)=>v.pid-I.pid||v.port-I.port||(v.address<I.address?-1:v.address>I.address?1:0));let g=[...new Set(f.map((v)=>v.pid))].slice(0,Mu),w=await Promise.all(g.map(async(v)=>[v,await ec(v,c)])),x=new Map(w),C=f.filter((v)=>{let I=x.get(v.pid);return Boolean(I&&Ja(e,I))}),R=new Map(await Promise.all([...new Set(C.map((v)=>v.pid))].map(async(v)=>[v,await Qa(v,c)])));return{ports:C.slice(0,$u).map((v)=>({pid:v.pid,command:R.get(v.pid)??null,address:v.address}))}}import{posix as $i}from"path";var kn=200,Yu=250,Xu=250;async function Tn(e,c){let l=await e(c);if(l.timedOut||l.truncated||l.exitCode!==0&&l.exitCode!==1)throw new r("process_inspection_failed","Reading this Mac's processes did not complete.");let m=[],f=null;for(let g of l.stdout.split(/\r?\n/))if(g.startsWith("p")){let w=Number(g.slice(1));if(f=Number.isInteger(w)&&w>0?{pid:w,command:null,names:[]}:null,f)m.push(f)}else if(f&&g.startsWith("c"))f.command=g.slice(1)||null;else if(f&&g.startsWith("n"))f.names.push(g.slice(1));return m}function Ni(e,c){return c===e||c.startsWith(e==="/"?e:`${e}/`)}var nc="/System/Volumes/Data",Ju=["/tmp","/var","/etc"];function Bi(e){let c=$i.normalize(e);if(c.startsWith(`${nc}/`))c=c.slice(nc.length);return Ju.find((m)=>c===m||c.startsWith(`${m}/`))?`/private${c}`:c}function oc(e){return e&&$i.isAbsolute(e)?Bi(e):null}async function ic(e,c){let l=new Map;for(let m=0;m<c.length;m+=kn){let f=c.slice(m,m+kn).join(",");for(let g of await Tn(e,["-a","-p",f,"-d","cwd","-Fpcn"]))l.set(g.pid,{command:g.command,cwd:oc(g.names[0])})}return l}async function sc(e,c){let l=Bi(e),m=(await Tn(c,["-d","cwd","-Fpn"])).filter((g)=>{let w=oc(g.names[0]);return w!==null&&Ni(l,w)}).map((g)=>g.pid).slice(0,Yu),f=await ic(c,m);return{processes:m.flatMap((g)=>{let w=f.get(g);return w?.cwd&&Ni(l,w.cwd)?[{pid:g,command:w.command,cwd:$i.relative(l,w.cwd)||"."}]:[]})}}async function ac(e,c){let l=Bi(e),m=["-nP","-iTCP","-sTCP:LISTEN","-Fpcn"],f=await Tn(c,m),g=await ic(c,f.map((R)=>R.pid)),w=f.map((R)=>R.pid).filter((R)=>{let v=g.get(R)?.cwd;return Boolean(v&&Ni(l,v))});if(w.length===0)return{ports:[]};let x=new Set(f.flatMap((R)=>R.names.map((v)=>`${R.pid} ${v}`))),C=[];for(let R=0;R<w.length;R+=kn){let v=w.slice(R,R+kn).join(",");for(let I of await Tn(c,["-a","-p",v,...m]))for(let L of I.names)if(x.has(`${I.pid} ${L}`))C.push({pid:I.pid,command:I.command,address:L})}return{ports:C.slice(0,Xu)}}import{join as lp}from"path";import{spawn as np}from"child_process";import{randomUUID as op}from"crypto";import{chmodSync as dc,lstatSync as uc,mkdirSync as ip,readdirSync as sp,statSync as ap,unlinkSync as cp}from"fs";import{join as Hi}from"path";var Fi={targets:24,assets:128,sourceFiles:2000,sourceBytes:20000000,outputBytes:20000000};var Dn=(e,c=0,l=1e6)=>typeof e==="number"&&Number.isFinite(e)&&e>=c&&e<=l;var Lt=()=>{throw Error("proof_visual_contract_invalid")};class cc extends Error{constructor(){super("proof_visual_contract_invalid")}}function Qr(e){if(!_e(e)||e.version!==1)return Lt();if(typeof e.route!=="string"||!e.route.startsWith("/")||e.route.length>512||/[\x00-\x20\x7f\\?#%]/.test(e.route)||e.route.startsWith("//"))throw new cc;if(!_e(e.viewport)||!Dn(e.viewport.width,1,4096)||!Dn(e.viewport.height,1,4096)||!Array.isArray(e.targets)||e.targets.length<1||e.targets.length>Fi.targets||Object.keys(e).some((m)=>!["version","route","viewport","targets","additionalViewports"].includes(m)))return Lt();let c=e.targets.map((m)=>{if(!_e(m)||typeof m.id!=="string"||!/^[a-zA-Z0-9_-]{1,64}$/.test(m.id)||typeof m.selector!=="string"||!m.selector.trim()||m.selector.length>256||/[\x00-\x1f\x7f]/.test(m.selector)||Object.keys(m).some((f)=>!["id","selector"].includes(f)))return Lt();return{id:m.id,selector:m.selector}});if(new Set(c.map((m)=>m.id)).size!==c.length)return Lt();let l;if(e.additionalViewports!==void 0){if(!Array.isArray(e.additionalViewports)||e.additionalViewports.length<1||e.additionalViewports.length>3)return Lt();l=e.additionalViewports.map((f)=>{if(!_e(f)||!Dn(f.width,1,4096)||!Number.isInteger(f.width)||!Dn(f.height,1,4096)||!Number.isInteger(f.height)||Object.keys(f).some((g)=>!["width","height"].includes(g)))return Lt();return{width:f.width,height:f.height}});let m=[e.viewport,...l].map((f)=>`${f.width}x${f.height}`);if(new Set(m).size!==m.length)return Lt()}return{version:1,route:e.route,viewport:{width:e.viewport.width,height:e.viewport.height},targets:c,...l?{additionalViewports:l}:{}}}var ep=["organizationId","userId","sessionId","runId"],tp=[...ep,"prUrl","headSha","skillDigest","evidenceKind"],c_=[...tp,"contextId","preparedAt","captureId","startedAt","finishedAt","sha256","kind","visualPlan","visualObservation"];var rp={"image/png":{kind:"image",directory:"/tmp/ara-public-screenshots",extension:"png",maxBytes:8388608},"video/webm":{kind:"video",directory:"/tmp/ara-public-recordings",extension:"webm",maxBytes:10551296}};function lc(e){return rp[e].directory}var pc=10485760;function mc(e={}){let c=e.directory??lc("video/webm"),l=null;return{async start(m){if(l)throw Error("cloud_browser_recording_active");let f=m?.seconds;if(!Number.isInteger(f)||Number(f)<1||Number(f)>15||!m||Object.keys(m).some((F)=>F!=="seconds"))throw Error("cloud_browser_recording_seconds_1_to_15_required");ip(c,{recursive:!0,mode:457});let g=uc(c);if(!g.isDirectory()||g.isSymbolicLink()||g.uid!==process.getuid?.())throw Error("cloud_browser_recording_directory_invalid");dc(c,457);let w=sp(c).filter((F)=>/^[a-f0-9-]{36}\.webm$/.test(F)).map((F)=>({name:F,time:ap(Hi(c,F)).mtimeMs})).sort((F,B)=>B.time-F.time);for(let F of w.slice(9))cp(Hi(c,F.name));let x=Hi(c,`${op()}.webm`),C=["-f","x11grab","-framerate","12","-i",e.display??":99"],R=(e.spawn??np)(e.ffmpeg??"ffmpeg",["-nostdin","-hide_banner","-loglevel","error","-y",...C,"-t",String(f),"-vf","scale=1280:-2","-c:v","libvpx","-deadline","realtime","-b:v","700k","-an","-fs",String(pc),"-progress","pipe:1",x],{stdio:["ignore","pipe","ignore"],...e.env?{env:e.env}:{}}),v,I,L=!1,N=new Promise((F,B)=>{v=F,I=B});R.stdout.on("data",(F)=>{if(/frame=\s*[1-9]/.test(String(F)))L=!0,v()});let M=new Promise((F,B)=>{R.once("error",()=>{I(Error("cloud_browser_recording_unavailable")),B(Error("cloud_browser_recording_unavailable"))}),R.once("exit",(V)=>{try{if(V!==0&&V!==255)throw Error();let z=uc(x);if(!L||!z.isFile()||z.isSymbolicLink()||z.uid!==process.getuid?.()||z.size<128||z.size>pc+65536)throw Error();dc(x,420),v(),F({path:x,mimeType:"video/webm"})}catch{I(Error("cloud_browser_recording_failed")),B(Error("cloud_browser_recording_failed"))}})});M.catch(()=>{});let U=setTimeout(()=>R.kill("SIGKILL"),(Number(f)+5)*1000);M.finally(()=>clearTimeout(U)).catch(()=>{}),l={done:M,stop:()=>(R.kill("SIGINT"),M)};try{await N}catch(F){throw l=null,F}return{recording:!0,seconds:Number(f)}},async stop(){if(!l)throw Error("cloud_browser_recording_not_started");let m=l;return l=null,m.stop()},async close(){if(l)await this.stop().catch(()=>{})}}}function fc(e,c={}){if(e.executionMode!=="unsandboxed"||!e.runtimeDirectory||(c.platform??process.platform)!=="linux")return null;let l=(c.components??P)(),m=l?.features.display?l.ffmpeg:null;if(!m)return null;let f=lp(e.runtimeDirectory,"recordings"),g=null;return{async start(w){let x=await(c.desktop??Be)();return g??=mc({directory:f,display:x.display,ffmpeg:m,env:{HOME:a(),PATH:"/usr/local/bin:/usr/bin:/bin",XAUTHORITY:x.xauthority},...c.spawn?{spawn:c.spawn}:{}}),g.start(w)},async stop(){if(!g)throw Error("cloud_browser_recording_not_started");return g.stop()},async close(){await g?.close()}}}import{spawn as _s}from"child_process";import{createHash as Ip,randomUUID as Ap}from"crypto";import{existsSync as tt,mkdirSync as ps,mkdtempSync as ys,readdirSync as lo,readFileSync as bs,renameSync as Lp,rmSync as Ur,statSync as oo,writeFileSync as kp}from"fs";import{homedir as ws,tmpdir as Nc}from"os";import{basename as Mc,dirname as ms,join as de,relative as $c,resolve as fs,sep as Bc}from"path";var We=t().min(1).max(200),et=o().finite().min(0).max(1e4),Nn=t().min(1).max(4096).refine((e)=>!e.includes("\x00")),hc=t().regex(/^[A-Za-z0-9][A-Za-z0-9.-]{0,254}$/),qi=i({id:t().min(1).max(500).optional(),label:t().min(1).max(500).optional()}).strict(),Vi=["home","lock","side_button","siri","apple_pay"],dp=s(["tree","screenshot","both","none"]),up=i({...qi.shape,gone:d().optional()}).strict().refine((e)=>Boolean(e.id||e.label),"wait_for needs an id or label"),St={observe:dp.optional(),wait_for:up.optional(),timeout:o().min(0).max(20).optional()},Wi=_("action",[i({action:n("tap"),x:et.optional(),y:et.optional(),...qi.shape,duration:o().min(0).max(10).optional()}).strict().refine((e)=>e.x!==void 0&&e.y!==void 0||Boolean(e.id||e.label),"pass x and y, or an id or label"),i({action:n("swipe"),x:et,y:et,x2:et,y2:et,duration:o().min(0.05).max(5).optional()}).strict(),i({action:n("type"),text:t().min(1).max(4000)}).strict(),i({action:n("button"),name:s(Vi)}).strict(),i({action:n("sleep"),seconds:o().min(0).max(10)}).strict()]),Gi=_("action",[i({action:n("devices")}).strict(),i({action:n("boot"),device:We}).strict(),i({action:n("shutdown"),device:We}).strict(),i({action:n("build"),path:Nn.optional(),scheme:t().min(1).max(200).optional(),configuration:t().min(1).max(100).optional(),device:We.optional(),wait:d().optional()}).strict(),i({action:n("run"),path:Nn.optional(),scheme:t().min(1).max(200).optional(),configuration:t().min(1).max(100).optional(),device:We.optional(),steps:u(yo(()=>Wi)).max(30).optional(),...St}).strict(),i({action:n("build_status"),build_id:t().regex(/^build-[0-9a-z-]{4,64}$/),device:We.optional(),wait:d().optional()}).strict(),i({action:n("launch"),device:We.optional(),app_path:Nn.optional(),bundle_id:hc.optional(),steps:u(yo(()=>Wi)).max(30).optional(),...St}).strict().refine((e)=>Boolean(e.app_path)!==Boolean(e.bundle_id),"pass exactly one of app_path or bundle_id"),i({action:n("terminate"),device:We.optional(),bundle_id:hc}).strict(),i({action:n("logs"),device:We.optional(),after:o().int().min(0).optional()}).strict(),i({action:n("screenshot"),device:We.optional(),scale:Q([n(1),n(2)]).optional(),save_path:Nn.optional()}).strict(),i({action:n("chrome"),device:We.optional()}).strict(),i({action:n("inspect"),device:We.optional()}).strict(),i({action:n("tap"),device:We.optional(),x:et.optional(),y:et.optional(),...qi.shape,duration:o().min(0).max(10).optional(),...St}).strict().refine((e)=>e.x!==void 0&&e.y!==void 0||Boolean(e.id||e.label),"pass x and y, or an id or label"),i({action:n("swipe"),device:We.optional(),x:et,y:et,x2:et,y2:et,duration:o().min(0.05).max(5).optional(),...St}).strict(),i({action:n("type"),device:We.optional(),text:t().min(1).max(4000),...St}).strict(),i({action:n("button"),device:We.optional(),name:s(Vi),...St}).strict(),i({action:n("open_url"),device:We.optional(),url:t().min(1).max(4000),...St}).strict(),i({action:n("steps"),device:We.optional(),steps:u(Wi).min(1).max(30),...St}).strict(),i({action:n("appearance"),device:We.optional(),mode:s(["light","dark"])}).strict()]),gc=i({udid:t(),name:t(),runtime:t(),state:s(["booted","shutdown","booting","shutting_down"]),kind:s(["iphone","ipad","other"])}).strict(),C_=i({text:t(),error:t().optional(),device:gc.optional(),devices:u(gc).optional(),image:i({mime:n("image/jpeg"),data:t(),width:o(),height:o()}).strict().optional(),build:i({id:t(),status:s(["running","succeeded","failed"]),app_path:t().optional(),bundle_id:t().optional(),errors:u(t()),log_tail:t(),elapsed_ms:o()}).strict().optional(),logs:i({lines:u(t()),next:o()}).strict().optional(),screen:t().optional(),chrome:i({identifier:t(),screen:i({width:o(),height:o()}).strict(),inset:i({top:o(),left:o(),bottom:o(),right:o()}).strict(),padding:i({top:o(),left:o(),bottom:o(),right:o()}).strict(),screen_mask:t().optional(),pieces:oe(s(["topLeft","top","topRight","right","bottomRight","bottom","bottomLeft","left"]),i({image:t(),width:o(),height:o()}).strict()),buttons:u(i({name:t(),image:t(),x:o(),y:o(),width:o(),height:o()}).strict())}).strict().optional()}).strict();var O_=i({device_id:A().optional(),root_id:A().optional()}),Mn={device_id:{type:"string",format:"uuid",description:"Reason machine id from devices.list; omit for the machine this Session runs on."},root_id:{type:"string",format:"uuid"},device:{type:"string",description:"Simulator UDID or exact name. Required for boot and shutdown; for other actions omit it for the booted one."},path:{type:"string",description:"build or run: a .xcodeproj, .xcworkspace, or a folder holding one (project.yml is generated with XcodeGen), absolute or relative to the Session's folder. Omit it when the folder holds one app project."},scheme:{type:"string"},configuration:{type:"string"},build_id:{type:"string",description:"build_status (required): the build_id a build or run returned."},app_path:{type:"string",description:"launch: the built .app from build_status (or pass bundle_id instead)."},bundle_id:{type:"string",description:"terminate (required); launch: an installed app's bundle id instead of app_path."},after:{type:"integer",minimum:0,description:"logs: only lines after this sequence number."},x:{type:"number",description:"tap (with y, unless id or label is given) or swipe (required): start point in device points."},y:{type:"number"},x2:{type:"number",description:"swipe (required, with y2): end point in device points."},y2:{type:"number"},id:{type:"string",description:"tap: accessibility identifier from inspect (instead of x and y)."},label:{type:"string",description:"tap: accessibility label from inspect (instead of x and y)."},duration:{type:"number",description:"tap: seconds held (above 0.5 is a long press); swipe: seconds."},text:{type:"string",description:"type (required): the text to type."},name:{type:"string",enum:[...Vi],description:"button (required)."},url:{type:"string",description:"open_url (required): the URL or deep link."},mode:{type:"string",enum:["light","dark"],description:"appearance (required)."},steps:{type:"array",maxItems:30,description:"steps (required, at least one) or launch and run: run in order in one call (after launch, once the app is up). Each item is {action:'tap', id|label|x,y} | {action:'swipe', x,y,x2,y2} | {action:'type', text} | {action:'button', name} | {action:'sleep', seconds}. Taps by id or label wait for their element to appear.",items:{type:"object"}},observe:{type:"string",enum:["tree","screenshot","both","none"],description:"After tap, swipe, type, button, open_url, launch or steps: what to return about the settled screen. Default tree (the accessibility tree, so no separate inspect is needed); screenshot or both to see it."},wait_for:{type:"object",description:"After the action, wait until this element is on screen: {id} or {label}; add gone:true to wait for it to disappear.",properties:{id:{type:"string"},label:{type:"string"},gone:{type:"boolean"}},additionalProperties:!1},timeout:{type:"number",description:"Seconds to wait for wait_for (default 5, max 20)."},wait:{type:"boolean",description:"build or build_status: wait for the build to finish (up to ~45 s) instead of returning at once."},save_path:{type:"string",description:"screenshot: also save the full-resolution PNG at this path (absolute or relative to the Session's folder), for example to show the user."}},yc=Gi.options.map((e)=>e.shape).filter((e)=>e.action.value!=="chrome"),pp={tap:[{required:["x","y"]},{required:["id"]},{required:["label"]}],launch:[{required:["app_path"],without:["bundle_id"]},{required:["bundle_id"],without:["app_path"]}]},_c=new Set;function mp(e,c){let{description:l,...m}=e==="steps"&&c==="steps"?{...Mn.steps,minItems:1}:Mn[e];if(l===void 0||_c.has(e))return m;return _c.add(e),{...m,description:l}}var fp=yc.flatMap((e)=>{let c=e.action.value,l=Object.keys(e).filter((f)=>Object.hasOwn(Mn,f)),m=l.filter((f)=>!e[f].safeParse(void 0).success);return(pp[c]??[{required:[]}]).map((f)=>({type:"object",properties:Object.fromEntries([["action",{type:"string",const:c}],...["device_id","root_id",...l].filter((g)=>!f.without?.includes(g)).map((g)=>[g,mp(g,c)])]),required:["action",...m,...f.required],additionalProperties:!1}))}),hp={type:"object",properties:{action:{type:"string",enum:yc.map((e)=>e.action.value)},...Mn},required:["action"],additionalProperties:!1},I_={...hp,anyOf:fp};import{spawn as ss}from"child_process";import{createHash as _p}from"crypto";import{existsSync as Ki,mkdirSync as Bn,mkdtempSync as yp,readdirSync as bc,readFileSync as wc,renameSync as bp,rmSync as Sc,symlinkSync as Ji,writeFileSync as Br}from"fs";import{homedir as wp}from"os";import{dirname as Ec,join as we}from"path";import{createInterface as Sp}from"readline";var zi=`// Reason's simulator host: one warm process per booted iOS Simulator.
-//
-// Built on the Mac on first use (cli/simulator-host.ts) against the MIT
-// FBSimulatorControl frameworks that the pinned AXe ships, so loading
-// SimulatorKit and connecting to the simulator happen once per process
-// instead of once per action (about a second each, three under load).
-//
-//   simulator-host serve <udid>
-//     Newline JSON requests on stdin, one newline JSON reply each on stdout,
-//     in order: {"id":1,"op":"tap","x":100,"y":200} -> {"id":1,"ok":true}.
-//     Ops: touch (phase down|move|up), tap, swipe, button, text, key, tree.
-//     Coordinates are device points. \`tree\` answers AXe describe-ui's JSON.
-//   simulator-host stream <udid> <fps> <max pixels> <kbps>
-//     H.264 (Main, level 4.2) as Annex-B on stdout, encoded with VideoToolbox
-//     straight from the simulator's framebuffer. Every keyframe carries
-//     SPS/PPS, and every access unit is followed by an AUD, so a reader that
-//     splits at AUDs has each frame as soon as it is written.
-//
-// Both modes exit when stdin closes, so they never outlive the worker.
-
-import CoreMedia
-import CoreVideo
-import Darwin
-import FBControlCore
-import FBSimulatorControl
-import Foundation
-import IOSurface
-import VideoToolbox
-
-@objc final class SilentReporter: NSObject, FBEventReporter {
-  var metadata: [String: String] = [:]
-  func report(_ subject: FBEventReporterSubject) {}
-  func addMetadata(_ metadata: [String: String]) {}
-}
-
-let logger: FBControlCoreLogger = FBControlCoreLoggerFactory.systemLoggerWriting(toStderr: false, withDebugLogging: false)
-
-func fail(_ message: String) -> Never {
-  FileHandle.standardError.write(Data((message + "\\n").utf8))
-  exit(1)
-}
-
-/// Writes all of \`data\` to stdout; a closed reader ends the process.
-func writeOut(_ data: Data) {
-  data.withUnsafeBytes { (buffer: UnsafeRawBufferPointer) in
-    var offset = 0
-    while offset < buffer.count {
-      let written = Darwin.write(1, buffer.baseAddress!.advanced(by: offset), buffer.count - offset)
-      if written <= 0 {
-        if written < 0 && errno == EINTR { continue }
-        exit(0)
-      }
-      offset += written
-    }
-  }
-}
-
-@MainActor
-func simulator(_ udid: String) async throws -> FBSimulator {
-  try FBSimulatorControlFrameworkLoader.essentialFrameworks.loadPrivateFrameworks(logger)
-  try FBSimulatorControlFrameworkLoader.xcodeFrameworks.loadPrivateFrameworks(logger)
-  FBControlCoreGlobalConfiguration.defaultLogger = logger
-  let configuration = FBSimulatorControlConfiguration(deviceSetPath: nil, logger: logger, reporter: SilentReporter())
-  let set = try FBSimulatorControl.withConfiguration(configuration).set
-  guard let target = set.allSimulators.first(where: { $0.udid == udid }) else { fail("simulator_not_found") }
-  guard target.state == .booted else { fail("simulator_not_booted") }
-  return target
-}
-
-// MARK: - serve
-
-/// US keyboard: character -> (HID usage, shift).
-let keyboard: [Character: (UInt32, Bool)] = {
-  var map: [Character: (UInt32, Bool)] = [:]
-  for (index, letter) in "abcdefghijklmnopqrstuvwxyz".enumerated() {
-    map[letter] = (UInt32(4 + index), false)
-    map[Character(letter.uppercased())] = (UInt32(4 + index), true)
-  }
-  for (index, digit) in "1234567890".enumerated() { map[digit] = (UInt32(30 + index), false) }
-  for (index, symbol) in "!@#$%^&*()".enumerated() { map[symbol] = (UInt32(30 + index), true) }
-  let plain: [(Character, UInt32)] = [("\\n", 40), ("\\t", 43), (" ", 44), ("-", 45), ("=", 46), ("[", 47), ("]", 48),
-    ("\\\\", 49), (";", 51), ("'", 52), ("\`", 53), (",", 54), (".", 55), ("/", 56)]
-  let shifted: [(Character, UInt32)] = [("_", 45), ("+", 46), ("{", 47), ("}", 48), ("|", 49), (":", 51), ("\\"", 52),
-    ("~", 53), ("<", 54), (">", 55), ("?", 56)]
-  for (character, usage) in plain { map[character] = (usage, false) }
-  for (character, usage) in shifted { map[character] = (usage, true) }
-  return map
-}()
-
-let buttons: [String: FBSimulatorHIDButton] = [
-  "home": .homeButton, "lock": .lock, "side_button": .sideButton, "siri": .siri, "apple_pay": .applePay,
-]
-
-/// AXe describe-ui's keys (its schema), so the worker parses one format either way.
-let treeKeys: Set<FBAXKeys> = [.label, .frame, .value, .uniqueID, .type, .title, .frameDict, .help, .enabled,
-  .customActions, .role, .roleDescription, .subrole, .contentRequired, .pid]
-
-func withTraits(_ value: Any) -> Any {
-  if let list = value as? [Any] { return list.map(withTraits) }
-  guard var element = value as? [String: Any] else { return value }
-  for (key, child) in element { element[key] = withTraits(child) }
-  if element["type"] != nil && element["traits"] == nil { element["traits"] = [String]() }
-  return element
-}
-
-func hasChildren(_ value: Any) -> Bool {
-  let roots = (value as? [[String: Any]]) ?? ((value as? [String: Any]).map { [$0] } ?? [])
-  return roots.contains { (($0["children"] as? [Any])?.isEmpty == false) }
-}
-
-@MainActor
-func readTree(_ target: FBSimulator) async throws -> String {
-  var latest: Any = []
-  for attempt in 0..<4 {
-    let element = try await target.accessibilityElementForFrontmostApplication()
-    defer { element.close() }
-    let response = try element.serialize(with: FBAccessibilityRequestOptions(nestedFormat: true, keys: treeKeys))
-    latest = withTraits(response.elements)
-    if hasChildren(latest) { break }
-    if attempt < 3 { try await Task.sleep(for: .milliseconds(50 << attempt)) }
-  }
-  let data = try JSONSerialization.data(withJSONObject: latest)
-  return String(decoding: data, as: UTF8.self)
-}
-
-@MainActor
-func handle(_ request: [String: Any], target: FBSimulator, hid: FBSimulatorHID) async throws -> [String: Any] {
-  let number = { (key: String) -> Double in
-    guard let value = request[key] as? Double else { throw NSError(domain: "simulator-host", code: 1, userInfo: [NSLocalizedDescriptionKey: "missing \\(key)"]) }
-    return value
-  }
-  switch request["op"] as? String {
-  case "touch":
-    let direction: FBSimulatorHIDDirection = (request["phase"] as? String) == "up" ? .up : .down
-    try await hid.send(event: .touch(direction: direction, x: try number("x"), y: try number("y")), logger: logger)
-  case "tap":
-    let duration = request["duration"] as? Double ?? 0
-    let event: FBSimulatorHIDEvent = duration > 0
-      ? .tapAt(x: try number("x"), y: try number("y"), duration: duration) : .tapAt(x: try number("x"), y: try number("y"))
-    try await hid.send(event: event, logger: logger)
-  case "swipe":
-    try await hid.send(event: .swipe(try number("x"), yStart: try number("y"), xEnd: try number("x2"), yEnd: try number("y2"),
-      delta: request["delta"] as? Double ?? 10, duration: request["duration"] as? Double ?? 0.3), logger: logger)
-  case "button":
-    guard let button = buttons[request["name"] as? String ?? ""] else { throw NSError(domain: "simulator-host", code: 1, userInfo: [NSLocalizedDescriptionKey: "unknown button"]) }
-    try await hid.send(event: .shortButtonPress(button), logger: logger)
-  case "text":
-    var events: [FBSimulatorHIDEvent] = []
-    for character in request["text"] as? String ?? "" {
-      guard let (usage, shift) = keyboard[character] else {
-        throw NSError(domain: "simulator-host", code: 2, userInfo: [NSLocalizedDescriptionKey: "unsupported character"])
-      }
-      if shift { events.append(.keyboard(direction: .down, keyCode: 225)) }
-      events.append(.keyboard(direction: .down, keyCode: usage))
-      events.append(.keyboard(direction: .up, keyCode: usage))
-      if shift { events.append(.keyboard(direction: .up, keyCode: 225)) }
-    }
-    if !events.isEmpty { try await hid.send(event: .composite(events), logger: logger) }
-  case "key":
-    let direction: FBSimulatorHIDDirection = (request["down"] as? Bool) == false ? .up : .down
-    try await hid.send(event: .keyboard(direction: direction, keyCode: UInt32(try number("usage"))), logger: logger)
-  case "tree":
-    return ["tree": try await readTree(target)]
-  default:
-    throw NSError(domain: "simulator-host", code: 1, userInfo: [NSLocalizedDescriptionKey: "unknown op"])
-  }
-  return [:]
-}
-
-@MainActor
-func serve(_ udid: String) async {
-  let target: FBSimulator
-  let hid: FBSimulatorHID
-  do {
-    target = try await simulator(udid)
-    hid = try await target.connectToHID()
-  } catch {
-    fail("connect_failed: \\(error.localizedDescription)")
-  }
-  writeOut(Data("{\\"ready\\":true}\\n".utf8))
-  do {
-    for try await line in FileHandle.standardInput.bytes.lines {
-      guard let request = (try? JSONSerialization.jsonObject(with: Data(line.utf8))) as? [String: Any] else { continue }
-      var reply: [String: Any]
-      do {
-        reply = try await handle(request, target: target, hid: hid)
-        reply["ok"] = true
-      } catch {
-        reply = ["ok": false, "error": error.localizedDescription]
-      }
-      reply["id"] = request["id"] ?? 0
-      var data = (try? JSONSerialization.data(withJSONObject: reply)) ?? Data("{\\"ok\\":false}".utf8)
-      data.append(0x0A)
-      writeOut(data)
-    }
-  } catch {}
-  exit(0)
-}
-
-// MARK: - stream
-
-let startCode = Data([0, 0, 0, 1])
-let accessUnitDelimiter = Data([0, 0, 0, 1, 0x09, 0xF0])
-
-struct BitReader {
-  let bytes: [UInt8]
-  var position = 0
-  mutating func bit() -> UInt32? {
-    guard position < bytes.count * 8 else { return nil }
-    defer { position += 1 }
-    return UInt32(bytes[position >> 3] >> (7 - UInt8(position & 7)) & 1)
-  }
-  mutating func bits(_ count: Int) -> UInt32? {
-    var value: UInt32 = 0
-    for _ in 0..<count { guard let next = bit() else { return nil }; value = value << 1 | next }
-    return value
-  }
-  mutating func ue() -> UInt32? {
-    var zeros = 0
-    while true { guard let next = bit() else { return nil }; if next == 1 { break }; zeros += 1; if zeros > 31 { return nil } }
-    guard let rest = bits(zeros) else { return nil }
-    return (1 << zeros) - 1 + rest
-  }
-}
-
-struct BitWriter {
-  var bytes: [UInt8] = []
-  var count = 0
-  mutating func bit(_ value: UInt32) {
-    if count & 7 == 0 { bytes.append(0) }
-    if value & 1 == 1 { bytes[bytes.count - 1] |= 1 << (7 - UInt8(count & 7)) }
-    count += 1
-  }
-  mutating func bits(_ value: UInt32, _ width: Int) { for shift in stride(from: width - 1, through: 0, by: -1) { bit(value >> UInt32(shift)) } }
-  mutating func ue(_ value: UInt32) {
-    let coded = value + 1
-    let width = 32 - coded.leadingZeroBitCount
-    bits(0, width - 1)
-    bits(coded, width)
-  }
-}
-
-/// The SPS with a VUI that says frames come out in decode order, one at a time. VideoToolbox writes no
-/// bitstream restriction, so a browser decoder may hold the newest frames back for reordering; on a
-/// screen that stops changing, the last one would never be shown. Any SPS this does not expect is kept.
-func lowDelaySps(_ nal: Data) -> Data {
-  var raw: [UInt8] = []
-  var zeros = 0
-  for byte in nal.dropFirst() {
-    if zeros >= 2 && byte == 3 { zeros = 0; continue }
-    raw.append(byte)
-    zeros = byte == 0 ? zeros + 1 : 0
-  }
-  var reader = BitReader(bytes: raw)
-  var writer = BitWriter()
-  func copyBits(_ width: Int) -> UInt32? { guard let value = reader.bits(width) else { return nil }; writer.bits(value, width); return value }
-  func copyUe() -> UInt32? { guard let value = reader.ue() else { return nil }; writer.ue(value); return value }
-  guard let profile = copyBits(8), copyBits(16) != nil, copyUe() != nil else { return nal }
-  if [100, 110, 122, 244, 44, 83, 86, 118, 128, 138, 139, 134, 135].contains(profile) {
-    guard let chroma = copyUe() else { return nal }
-    if chroma == 3 { guard copyBits(1) != nil else { return nal } }
-    guard copyUe() != nil, copyUe() != nil, copyBits(1) != nil, let scaling = copyBits(1), scaling == 0 else { return nal }
-  }
-  guard copyUe() != nil, let pocType = copyUe() else { return nal }
-  if pocType == 0 { guard copyUe() != nil else { return nal } } else if pocType != 2 { return nal }
-  guard let references = copyUe(), copyBits(1) != nil, copyUe() != nil, copyUe() != nil, let frameOnly = copyBits(1) else { return nal }
-  if frameOnly == 0 { guard copyBits(1) != nil else { return nal } }
-  guard copyBits(1) != nil, let cropping = copyBits(1) else { return nal }
-  if cropping == 1 { for _ in 0..<4 { guard copyUe() != nil else { return nal } } }
-  guard reader.bits(1) == 0 else { return nal }
-  writer.bit(1) // vui_parameters_present_flag
-  writer.bits(0, 6) // aspect ratio, overscan, video signal, chroma location, timing, NAL HRD
-  writer.bit(0) // VCL HRD
-  writer.bit(0) // pic_struct_present_flag
-  writer.bit(1) // bitstream_restriction_flag
-  writer.bit(1) // motion_vectors_over_pic_boundaries_flag
-  writer.ue(2); writer.ue(1); writer.ue(16); writer.ue(16)
-  writer.ue(0) // max_num_reorder_frames
-  writer.ue(max(1, references)) // max_dec_frame_buffering
-  writer.bit(1) // rbsp_stop_one_bit
-  while writer.count & 7 != 0 { writer.bit(0) }
-  var out = Data([nal.first!])
-  zeros = 0
-  for byte in writer.bytes {
-    if zeros >= 2 && byte <= 3 { out.append(3); zeros = 0 }
-    out.append(byte)
-    zeros = byte == 0 ? zeros + 1 : 0
-  }
-  return out
-}
-
-final class Encoder: NSObject, FBFramebufferConsumer, @unchecked Sendable {
-  let queue = DispatchQueue(label: "simulator-host.encode")
-  let fps: Int
-  let maxPixels: Double
-  let kbps: Int
-  var surface: IOSurface?
-  var dirty = true
-  var forceKey = true
-  var session: VTCompressionSession?
-  var transfer: VTPixelTransferSession?
-  var size = (width: 0, height: 0)
-  var frames: Int64 = 0
-
-  init(fps: Int, maxPixels: Double, kbps: Int) {
-    self.fps = fps
-    self.maxPixels = maxPixels
-    self.kbps = kbps
-  }
-
-  func didChange(_ surface: IOSurface?) {
-    self.surface = surface
-    dirty = true
-    forceKey = true
-  }
-
-  func didReceiveDamageRect() { dirty = true }
-
-  /// The encoded picture: the framebuffer scaled to stay within \`maxPixels\`, even sides.
-  func outputSize(_ surface: IOSurface) -> (width: Int, height: Int) {
-    let width = Double(IOSurfaceGetWidth(surface)), height = Double(IOSurfaceGetHeight(surface))
-    let fit = min(1, (maxPixels / (width * height)).squareRoot())
-    let even = { (value: Double) in max(2, Int(value * fit) / 2 * 2) }
-    return (even(width), even(height))
-  }
-
-  func makeSession(_ width: Int, _ height: Int) {
-    if let session { VTCompressionSessionInvalidate(session) }
-    var created: VTCompressionSession?
-    let status = VTCompressionSessionCreate(allocator: nil, width: Int32(width), height: Int32(height),
-      codecType: kCMVideoCodecType_H264, encoderSpecification: nil, imageBufferAttributes: nil,
-      compressedDataAllocator: nil, outputCallback: nil, refcon: nil, compressionSessionOut: &created)
-    guard status == noErr, let created else { fail("encoder_failed \\(status)") }
-    let set = { (key: CFString, value: CFTypeRef) in _ = VTSessionSetProperty(created, key: key, value: value) }
-    set(kVTCompressionPropertyKey_RealTime, kCFBooleanTrue)
-    set(kVTCompressionPropertyKey_ProfileLevel, kVTProfileLevel_H264_Main_4_2)
-    set(kVTCompressionPropertyKey_AllowFrameReordering, kCFBooleanFalse)
-    set(kVTCompressionPropertyKey_MaxFrameDelayCount, 0 as CFNumber)
-    set(kVTCompressionPropertyKey_ExpectedFrameRate, fps as CFNumber)
-    set(kVTCompressionPropertyKey_AverageBitRate, (kbps * 1000) as CFNumber)
-    // Keyframes come from a (re)start or a framebuffer change; this is only a safety net.
-    set(kVTCompressionPropertyKey_MaxKeyFrameIntervalDuration, 60 as CFNumber)
-    VTCompressionSessionPrepareToEncodeFrames(created)
-    session = created
-    size = (width, height)
-    var createdTransfer: VTPixelTransferSession?
-    VTPixelTransferSessionCreate(allocator: nil, pixelTransferSessionOut: &createdTransfer)
-    transfer = createdTransfer
-  }
-
-  func tick() {
-    guard dirty, let surface else { return }
-    dirty = false
-    let wanted = outputSize(surface)
-    if session == nil || wanted.width != size.width || wanted.height != size.height { makeSession(wanted.width, wanted.height) }
-    guard let session, let transfer, let pool = VTCompressionSessionGetPixelBufferPool(session) else { return }
-    var source: Unmanaged<CVPixelBuffer>?
-    guard CVPixelBufferCreateWithIOSurface(nil, surface, nil, &source) == kCVReturnSuccess, let source else { return }
-    let input = source.takeRetainedValue()
-    var output: CVPixelBuffer?
-    guard CVPixelBufferPoolCreatePixelBuffer(nil, pool, &output) == kCVReturnSuccess, let output else { return }
-    guard VTPixelTransferSessionTransferImage(transfer, from: input, to: output) == noErr else { return }
-    let time = CMTime(value: frames, timescale: CMTimeScale(fps))
-    frames += 1
-    let options = forceKey ? [kVTEncodeFrameOptionKey_ForceKeyFrame: kCFBooleanTrue] as CFDictionary : nil
-    forceKey = false
-    VTCompressionSessionEncodeFrame(session, imageBuffer: output, presentationTimeStamp: time, duration: .invalid,
-      frameProperties: options, infoFlagsOut: nil) { status, _, sample in
-      guard status == noErr, let sample else { return }
-      Encoder.write(sample)
-    }
-  }
-
-  /// One access unit as Annex-B, then the next unit's AUD: the reader splits at AUDs, so the unit is complete now.
-  static func write(_ sample: CMSampleBuffer) {
-    guard let block = CMSampleBufferGetDataBuffer(sample), let format = CMSampleBufferGetFormatDescription(sample) else { return }
-    let attachments = CMSampleBufferGetSampleAttachmentsArray(sample, createIfNecessary: false) as? [[CFString: Any]]
-    let key = !((attachments?.first?[kCMSampleAttachmentKey_NotSync] as? Bool) ?? false)
-    var unit = Data()
-    if key {
-      var count = 0
-      CMVideoFormatDescriptionGetH264ParameterSetAtIndex(format, parameterSetIndex: 0, parameterSetPointerOut: nil,
-        parameterSetSizeOut: nil, parameterSetCountOut: &count, nalUnitHeaderLengthOut: nil)
-      for index in 0..<count {
-        var pointer: UnsafePointer<UInt8>?
-        var length = 0
-        CMVideoFormatDescriptionGetH264ParameterSetAtIndex(format, parameterSetIndex: index, parameterSetPointerOut: &pointer,
-          parameterSetSizeOut: &length, parameterSetCountOut: nil, nalUnitHeaderLengthOut: nil)
-        guard let pointer, length > 0 else { continue }
-        let set = Data(bytes: pointer, count: length)
-        unit.append(startCode)
-        unit.append(set[set.startIndex] & 0x1F == 7 ? lowDelaySps(set) : set)
-      }
-    }
-    var total = 0
-    var base: UnsafeMutablePointer<CChar>?
-    guard CMBlockBufferGetDataPointer(block, atOffset: 0, lengthAtOffsetOut: nil, totalLengthOut: &total, dataPointerOut: &base) == noErr,
-      let base else { return }
-    var offset = 0
-    while offset + 4 <= total {
-      var length: UInt32 = 0
-      memcpy(&length, base.advanced(by: offset), 4)
-      let nal = Int(CFSwapInt32BigToHost(length))
-      offset += 4
-      guard offset + nal <= total else { break }
-      unit.append(startCode)
-      base.advanced(by: offset).withMemoryRebound(to: UInt8.self, capacity: nal) { unit.append($0, count: nal) }
-      offset += nal
-    }
-    unit.append(accessUnitDelimiter)
-    writeOut(unit)
-  }
-}
-
-@MainActor
-func stream(_ udid: String, fps: Int, maxPixels: Double, kbps: Int) async {
-  let target: FBSimulator
-  let framebuffer: FBFramebuffer
-  do {
-    target = try await simulator(udid)
-    framebuffer = try FBFramebuffer.mainScreenSurface(for: target, logger: logger)
-  } catch {
-    fail("connect_failed: \\(error.localizedDescription)")
-  }
-  let encoder = Encoder(fps: fps, maxPixels: maxPixels, kbps: kbps)
-  let first = framebuffer.attach(encoder, on: encoder.queue)
-  encoder.queue.async { if let first, encoder.surface == nil { encoder.surface = first } }
-  writeOut(accessUnitDelimiter)
-  let timer = DispatchSource.makeTimerSource(queue: encoder.queue)
-  timer.schedule(deadline: .now(), repeating: .nanoseconds(1_000_000_000 / max(1, fps)))
-  timer.setEventHandler { encoder.tick() }
-  timer.resume()
-  // "key" on stdin asks for a keyframe; end of stdin ends the stream.
-  do {
-    for try await line in FileHandle.standardInput.bytes.lines where line == "key" {
-      encoder.queue.async { encoder.forceKey = true; encoder.dirty = true }
-    }
-  } catch {}
-  framebuffer.detach(encoder)
-  _ = target
-  exit(0)
-}
-
-// MARK: - main
-
-signal(SIGPIPE, SIG_IGN)
-let arguments = CommandLine.arguments
-guard arguments.count >= 3 else { fail("usage: simulator-host serve|stream <udid> ...") }
-switch arguments[1] {
-case "serve":
-  await serve(arguments[2])
-case "stream":
-  guard arguments.count == 6, let fps = Int(arguments[3]), let maxPixels = Double(arguments[4]), let kbps = Int(arguments[5]) else {
-    fail("usage: simulator-host stream <udid> <fps> <max pixels> <kbps>")
-  }
-  await stream(arguments[2], fps: fps, maxPixels: maxPixels, kbps: kbps)
-default:
-  fail("usage: simulator-host serve|stream <udid> ...")
-}
-`;var vc=process.arch==="arm64"?"arm64-apple-macos":"x86_64-apple-macos",vp=180000,xp=15000,Rp=30000,Ep=600000,Pp=["SimDevice","SimDeviceSet","SimDeviceType","SimRuntime"].map((e)=>`@interface ${e} : NSObject
-@end
-`).join("");function xc(e,c,l){return new Promise((m)=>{let f=ss(e,c,{stdio:["ignore","pipe","pipe"],timeout:l}),g="";f.stdout.on("data",(w)=>{g+=w}),f.stderr.on("data",(w)=>{g+=w}),f.once("error",(w)=>m({code:-1,output:String(w)})),f.once("close",(w)=>m({code:w??-1,output:g}))})}var Rc=new Map;function as(e){let c=we(Ec(e),"Frameworks"),l=Rc.get(c);if(!l)Rc.set(c,l=Cp(c));return l}async function Cp(e){if(process.platform!=="darwin"||!Ki(we(e,"FBSimulatorControl.framework")))return null;let c=await xc("xcrun",["swiftc","--version"],30000);if(c.code!==0)return null;let l=_p("sha256").update(zi).update(c.output).update(e).digest("hex").slice(0,16),m=we(wp(),".local","share","reason","simulator","host"),f=we(m,l,"simulator-host");if(Ki(f))return f;Bn(m,{recursive:!0,mode:448});let g=yp(we(m,".staging-"));try{let w=we(g,"Frameworks"),x=we(w,"FBSimulatorControl.framework"),C=we(x,"Modules","FBSimulatorControl.swiftmodule");Bn(C,{recursive:!0});for(let U of bc(e))if(U!=="FBSimulatorControl.framework")Ji(we(e,U),we(w,U));let R=we(e,"FBSimulatorControl.framework");Ji(we(R,"FBSimulatorControl"),we(x,"FBSimulatorControl")),Ji(we(R,"Headers"),we(x,"Headers")),Br(we(x,"Modules","module.modulemap"),wc(we(R,"Modules","module.modulemap")));let v=wc(we(R,"Modules","FBSimulatorControl.swiftmodule",`${vc}.swiftinterface`),"utf8");Br(we(C,`${vc}.swiftinterface`),v.replace(/FBSimulatorControl\.(?=[A-Za-z_])/g,"").replace(/IOSurface\.IOSurface/g,"IOSurface"));let I=we(g,"include","CoreSimulator");Bn(I,{recursive:!0}),Br(we(I,"module.modulemap"),`module CoreSimulator {
-  header "CoreSimulator.h"
-  export *
-}
-`),Br(we(I,"CoreSimulator.h"),`#import <Foundation/Foundation.h>
-${Pp}`);let L=we(g,"main.swift");Br(L,zi);let N=we(g,"simulator-host"),M=await xc("xcrun",["swiftc","-O","-F",w,"-I",we(g,"include"),"-module-cache-path",we(g,"cache"),"-Xlinker","-rpath","-Xlinker",e,L,"-o",N],vp);if(M.code!==0||!Ki(N))return process.stderr.write(`Reason: the simulator host did not build; simulator actions use AXe.
-${M.output.slice(-2000)}
-`),null;Bn(Ec(f),{recursive:!0}),bp(N,f);for(let U of bc(m))if(U!==l&&!U.startsWith(".staging-"))Sc(we(m,U),{recursive:!0,force:!0});return f}catch{return null}finally{Sc(g,{recursive:!0,force:!0})}}class Fr extends Error{}class Yt extends Error{}class Pc{child;onGone;nextId=1;pending=new Map;idle;gone=!1;constructor(e,c){this.child=e;this.onGone=c;Sp({input:e.stdout}).on("line",(m)=>{let f;try{f=JSON.parse(m)}catch{return}let g=this.pending.get(Number(f.id));if(!g)return;if(this.pending.delete(Number(f.id)),clearTimeout(g.timer),f.ok===!0)g.resolve(f);else g.reject(new Fr(String(f.error??"The simulator refused the action.")))}),e.once("exit",()=>this.end()),e.once("error",()=>this.end()),this.touch()}call(e){if(this.gone)return Promise.reject(new Yt("The simulator host has exited."));this.touch();let c=this.nextId++;return new Promise((l,m)=>{let f=setTimeout(()=>{this.pending.delete(c),m(new Yt("The simulator host did not answer.")),this.close()},Rp);this.pending.set(c,{resolve:l,reject:m,timer:f}),this.child.stdin.write(`${JSON.stringify({id:c,...e})}
-`)})}close(){if(this.child.exitCode===null&&this.child.signalCode===null)this.child.kill("SIGTERM");this.end()}touch(){clearTimeout(this.idle),this.idle=setTimeout(()=>this.close(),Ep),this.idle.unref?.()}end(){if(this.gone)return;this.gone=!0,clearTimeout(this.idle);for(let e of this.pending.values())clearTimeout(e.timer),e.reject(new Yt("The simulator host has exited."));this.pending.clear(),this.onGone()}}var zt=new Map;async function jn(e,c,l=!1){let m=zt.get(c);if(!m){let f={started:Op(e,c)};zt.set(c,m=f),f.started.then((g)=>{if(f.host=g,!g&&zt.get(c)===f)zt.delete(c)})}if(m.host!==void 0)return m.host;return l?m.started:null}async function Op(e,c){let l=await as(e);if(!l)return null;let m=ss(l,["serve",c],{stdio:["pipe","pipe","ignore"]});if(!await new Promise((w)=>{let x=setTimeout(()=>w(!1),xp);m.stdout.once("data",(C)=>{clearTimeout(x),w(String(C).includes('"ready":true'))}),m.once("exit",()=>{clearTimeout(x),w(!1)}),m.once("error",()=>{clearTimeout(x),w(!1)})})){if(m.exitCode===null)m.kill("SIGTERM");return null}let g=new Pc(m,()=>{let w=zt.get(c);if(w&&(w.host===g||w.host===void 0))zt.delete(c)});return g}function Cc(e,c,l,m,f){return ss(e,["stream",c,String(l),String(Math.round(m)),String(f)],{stdio:["pipe","pipe","ignore"]})}var Xt={version:"1.8.0",url:"https://github.com/cameroncooke/AXe/releases/download/v1.8.0/AXe-macOS-v1.8.0-universal.tar.gz",sha256:"7b76340b72e90d0f211bc7c4636f15009076eff07acef2f2b632b175debd8834"},Tp=50000,Dp=112640,Np=174080,cs=2,Mp=60000,$p=2000,Bp=300,Fp=40,Up=new Set(["file:","javascript:","data:","vbscript:","blob:"]);function pr(e,c,l={}){return new Promise((m,f)=>{let g=_s(e,c,{cwd:l.cwd,stdio:["ignore","pipe","pipe"],signal:l.signal}),w=[],x=[];g.stdout.on("data",(R)=>w.push(R)),g.stderr.on("data",(R)=>x.push(R));let C=setTimeout(()=>g.kill("SIGKILL"),l.timeoutMs??Tp);g.on("error",(R)=>{clearTimeout(C),f(R)}),g.on("close",(R)=>{clearTimeout(C),m({code:R??-1,stdout:Buffer.concat(w).toString("utf8"),stderr:Buffer.concat(x).toString("utf8")})})})}function ye(e,c){throw new r(e,c)}async function He(e,c,l,m={}){let f=await pr(e,c,m);if(f.code!==0)ye("simulator_command_failed",`${l} failed: ${(f.stderr||f.stdout).trim().slice(-1500)}`);return f.stdout}function Hr(){return process.platform==="darwin"&&tt("/Library/Developer/PrivateFrameworks/CoreSimulator.framework")&&tt("/usr/bin/xcrun")}var ls=null;function Dt(){return de(ws(),".local","share","reason","simulator","axe")}function Ss(){let e=de(Dt(),Xt.version,"axe");if(tt(e))return Promise.resolve(e);return ls??=(async()=>{ps(Dt(),{recursive:!0,mode:448});let c=ys(de(Dt(),".staging-"));try{let l=de(c,"axe.tgz");await Ui(Xt.url,Xt.sha256,l);let m=de(c,"tree");if(ps(m),await He("tar",["-xzf",l,"-C",m],"Extracting AXe"),!tt(de(m,"axe"))||!tt(de(m,"Frameworks")))ye("simulator_axe_missing","The AXe archive has an unexpected layout.");Ur(de(Dt(),Xt.version),{recursive:!0,force:!0}),Lp(m,de(Dt(),Xt.version));for(let f of lo(Dt()))if(f!==Xt.version&&!f.startsWith(".staging-"))Ur(de(Dt(),f),{recursive:!0,force:!0});return e}finally{Ur(c,{recursive:!0,force:!0}),ls=null}})(),ls}var Fc=Ss;async function Uc(e){let c=await Ss().catch(()=>null);return c?jn(c,e.udid).catch(()=>null):null}async function so(e,c,l){let m=await Ss().catch(()=>ye("simulator_axe_missing","AXe could not be installed on this Mac.")),f=await pr(m,[...e,"--udid",c]);if(f.code===0)return f.stdout;let g=(f.stderr||f.stdout).trim();if(/no (matching |accessibility )?element|element not found|could not find|no elements? match/i.test(g))ye("simulator_element_not_found",g.slice(-500));return ye("simulator_command_failed",`${l} failed: ${g.slice(-1500)}`)}function Hp(e){let c=e.match(/SimRuntime\.([A-Za-z]+)-(\d+)-(\d+)(?:-(\d+))?$/);return c?`${c[1]} ${c[2]}.${c[3]}${c[4]?`.${c[4]}`:""}`:e}function jp(e){switch(e){case"Booted":return"booted";case"Booting":return"booting";case"Shutting Down":return"shutting_down";default:return"shutdown"}}async function vs(){let c=JSON.parse(await He("xcrun",["simctl","list","devices","available","-j"],"Listing simulators")).devices??{},l=[];for(let[m,f]of Object.entries(c)){if(!m.includes("SimRuntime.iOS"))continue;for(let g of f){if(g.isAvailable===!1)continue;let w=g.name.toLowerCase();if(g.deviceTypeIdentifier)hs.set(g.udid,g.deviceTypeIdentifier);l.push({udid:g.udid,name:g.name,runtime:Hp(m),state:jp(g.state),kind:w.includes("iphone")?"iphone":w.includes("ipad")?"ipad":"other"})}}return l.sort((m,f)=>Number(f.state==="booted")-Number(m.state==="booted")||f.runtime.localeCompare(m.runtime,void 0,{numeric:!0})||m.name.localeCompare(f.name))}var hs=new Map,gs=null;async function Ge(e,c){let l=await vs(),m;if(e){let f=l.filter((g)=>g.udid===e||g.name===e);if(m=f.find((g)=>g.state==="booted")??f[0],!m)ye("simulator_device_not_found",`No simulator named "${e}". Call devices to list them.`)}else{let f=l.filter((g)=>g.state==="booted");if(m=f.find((g)=>g.udid===gs)??f.find((g)=>g.kind==="iphone")??f[0],!m)ye("simulator_not_booted","No simulator is booted. Call devices, then boot one.")}if(c.booted&&m.state!=="booted")ye("simulator_not_booted",`${m.name} is not booted. Boot it first.`);return gs=m.udid,m}function Ee(e){return`${e.name} (${e.runtime})`}async function Wp(e){if(e.state!=="booted"){let c=await pr("xcrun",["simctl","boot",e.udid]);if(c.code!==0&&!/current state: Booted/i.test(c.stderr))ye("simulator_command_failed",`Booting ${e.name} failed: ${c.stderr.trim().slice(-1000)}`);await He("xcrun",["simctl","bootstatus",e.udid,"-b"],`Waiting for ${e.name} to boot`,{timeoutMs:45000})}return gs=e.udid,{...e,state:"booted"}}function xs(e,c){let l=fs(e,c),m=$c(e,l);if(m.startsWith("..")||m.startsWith(Bc)||fs(e,m)!==l)ye("simulator_path_outside_root",`${c} is outside this machine's granted folder (${e}). Pass a path inside it, or one relative to it.`);return l}var Oc=4,qp=new Set(["node_modules","Pods","DerivedData","build","Carthage","vendor"]);function Vp(e){let c=[],l=(m,f)=>{let g;try{g=lo(m)}catch{return}if(g.includes("project.yml")||g.some((w)=>w.endsWith(".xcworkspace")||w.endsWith(".xcodeproj"))){c.push(m);return}if(f>=Oc)return;for(let w of g.sort()){if(w.startsWith(".")||qp.has(w))continue;let x=de(m,w);try{if(oo(x).isDirectory())l(x,f+1)}catch{}}};if(l(e,0),c.length===1)return c[0];if(!c.length)ye("simulator_project_not_found",`No Xcode project or project.yml within ${Oc} folders of ${e}; pass path.`);return ye("simulator_project_not_found",`${e} holds several Xcode projects; pass path as one of: ${c.map((m)=>$c(e,m)||".").join(", ")}.`)}var ur=new Map;async function Gp(e){if(e.endsWith(".xcworkspace"))return{flag:"-workspace",path:e,dir:ms(e)};if(e.endsWith(".xcodeproj"))return{flag:"-project",path:e,dir:ms(e)};if(!oo(e).isDirectory())ye("simulator_project_not_found",`${e} is not a project, workspace or folder.`);let c=(f)=>lo(e).filter((g)=>g.endsWith(f)).sort();if(tt(de(e,"project.yml")))await He("xcodegen",["generate","--quiet"],"xcodegen generate",{cwd:e,timeoutMs:45000}).catch((f)=>tt("/opt/homebrew/bin/xcodegen")?He("/opt/homebrew/bin/xcodegen",["generate","--quiet"],"xcodegen generate",{cwd:e,timeoutMs:45000}):Promise.reject(f));let l=c(".xcworkspace")[0];if(l)return{flag:"-workspace",path:de(e,l),dir:e};let m=c(".xcodeproj")[0];if(m)return{flag:"-project",path:de(e,m),dir:e};return ye("simulator_project_not_found",`No .xcodeproj or .xcworkspace in ${e}.`)}async function Hc(e){let c=JSON.parse(await He("xcodebuild",["-list","-json",e.flag,e.path],"Listing schemes"));return c.workspace?.schemes??c.project?.schemes??[]}async function zp(e){let c=(await Hc(e))[0];if(!c)ye("simulator_build_no_scheme",`${e.path} has no schemes; pass scheme.`);return c}function Kp(e){let c=[],l=new Set;return e.forEach((m,f)=>{if(c.length>=20||!/(^|\s)error: /.test(m)||m.startsWith("note:")||l.has(m))return;l.add(m);let g=e.slice(f+1,f+3).filter((w)=>w.trim()!==""&&!/(^|\s)(error|warning|note): /.test(w));c.push([m,...g].join(`
-`).slice(0,800))}),c}async function Yp(e,c,l){if(e.ended=Date.now(),c!==0){if(e.log.some((g)=>g.includes("does not contain a scheme named"))){let g=await Hc(l).catch(()=>[]);if(g.length)e.log.push(`error: this project's schemes are: ${g.join(", ")}`)}e.status="failed";return}let m=de(e.productsDir,`${e.configuration}-iphonesimulator`),f=tt(m)?lo(m).filter((g)=>g.endsWith(".app")).map((g)=>de(m,g)).sort((g,w)=>oo(w).mtimeMs-oo(g).mtimeMs):[];if(e.appPath=f[0],e.appPath)e.bundleId=await qc(e.appPath).catch(()=>{return});if(e.status=e.appPath?"succeeded":"failed",!e.appPath)e.log.push("error: the build succeeded but produced no .app for the iOS Simulator")}async function Ic(e,c){let l=e.path?xs(c,e.path):Vp(c),m=await Gp(l),f=e.scheme??await zp(m),g=e.configuration??"Debug",w=await Ge(e.device,{booted:!1}).catch(()=>null),x=w?`platform=iOS Simulator,id=${w.udid}`:"generic/platform=iOS Simulator",C=Ip("sha256").update(m.path).digest("hex").slice(0,16),R=de(ws(),"Library","Caches","reason","simulator-builds",C),v={id:`build-${Ap().slice(0,8)}`,status:"running",started:Date.now(),log:[],productsDir:de(R,"Build","Products"),configuration:g};ur.set(v.id,v);for(let[M,U]of ur)if(ur.size>20&&U.status!=="running")ur.delete(M);let I=_s("xcodebuild",[m.flag,m.path,"-scheme",f,"-configuration",g,"-destination",x,"-derivedDataPath",R,"-skipMacroValidation","build"],{cwd:m.dir,stdio:["ignore","pipe","pipe"]}),L="",N=(M)=>{let U=(L+M.toString("utf8")).split(`
-`);if(L=U.pop()??"",v.log.push(...U),v.log.length>5000)v.log.splice(0,v.log.length-5000)};return I.stdout.on("data",N),I.stderr.on("data",N),I.on("error",(M)=>{v.log.push(`error: ${M.message}`),v.status="failed",v.ended=Date.now()}),I.on("close",(M)=>{if(L)v.log.push(L);Yp(v,M??-1,m)}),{text:`Build ${v.id} started: ${f} (${g}) for ${w?Ee(w):"the iOS Simulator"}. Poll build_status with this build_id; a first build can take minutes, later ones are incremental.`,build:jc(v)}}function jc(e){return{id:e.id,status:e.status,errors:Kp(e.log),log_tail:e.log.slice(-Fp).join(`
-`).slice(-4000),elapsed_ms:(e.ended??Date.now())-e.started,...e.appPath?{app_path:e.appPath}:{},...e.bundleId?{bundle_id:e.bundleId}:{}}}var Xp=45000,Jp=30000;async function ds(e,c=Xp){let l=Date.now()+c;while(ur.get(e)?.status==="running"&&Date.now()<l)await Bun.sleep(500);let m=Wc(e);return m.build?.status==="running"?{...m,text:`${m.text} Still running: call build_status with wait again.`}:m}function Wc(e){let c=ur.get(e);if(!c)ye("simulator_build_not_found",`No build ${e} on this Mac (a worker restart forgets builds); start a new one.`);let l=jc(c);return{text:c.status==="running"?`Build ${e} is running (${Math.round(l.elapsed_ms/1000)} s).`:c.status==="succeeded"?`Build ${e} succeeded: ${c.appPath}. Launch it with app_path.`:`Build ${e} failed with ${l.errors.length} error(s).`,build:l}}async function qc(e){return(await He("plutil",["-extract","CFBundleIdentifier","raw","-o","-",de(e,"Info.plist")],"Reading the bundle id")).trim()}var Rt=new Map;function Zp(e,c){Rt.get(e.udid)?.stop();let l=_s("script",["-q","/dev/null","xcrun","simctl","launch","--console-pty","--terminate-running-process",e.udid,c],{stdio:["ignore","pipe","pipe"]}),m={udid:e.udid,bundleId:c,lines:[],first:0,stop:()=>l.kill("SIGTERM")};Rt.set(e.udid,m);let f="",g=(w)=>{let x=(f+w.toString("utf8").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\r]/g,"")).split(`
-`);f=x.pop()??"",m.lines.push(...x);let C=m.lines.length-$p;if(C>0)m.lines.splice(0,C),m.first+=C};return l.stdout.on("data",g),l.stderr.on("data",g),new Promise((w)=>{let x=setTimeout(()=>w(null),15000),C=()=>{let R=m.lines.concat(f).join(`
-`).match(new RegExp(`${c.replace(/\./g,"\\.")}: (\\d+)`))?.[1];if(R)clearTimeout(x),w(Number(R))};l.stdout.on("data",C),l.on("close",()=>{clearTimeout(x),w(null)})})}async function Qp(e,c){let l=await Ge(e.device,{booted:!0}),m=e.bundle_id;if(e.app_path){let g=em(c,e.app_path);await He("xcrun",["simctl","install",l.udid,g],`Installing ${Mc(g)}`),m=await qc(g)}if(e.bundle_id){if((await pr("xcrun",["simctl","get_app_container",l.udid,e.bundle_id])).code!==0)ye("simulator_app_not_installed",`${e.bundle_id} is not installed on ${Ee(l)}.`)}let f=await Zp(l,m);if(f===null){let g=Rt.get(l.udid)?.lines.slice(-20).join(`
-`)??"";ye("simulator_launch_failed",`${m} did not start on ${Ee(l)}.${g?`
-${g}`:""}`)}return{text:`Launched ${m} on ${Ee(l)} (pid ${f}). Its console is captured; read it with logs.`,device:l}}function em(e,c){let l=fs(c),m=de(ws(),"Library","Caches","reason","simulator-builds")+Bc;return l.startsWith(m)&&l.endsWith(".app")?l:xs(e,l)}function tm(e,c){let l=Rt.get(e.udid);if(!l)return{text:`No app launched by Reason is running on ${Ee(e)}; launch one to capture its capture.`,logs:{lines:[],next:0}};let m=Math.max(c??0,l.first,l.first+l.lines.length-Bp),f=l.lines.slice(m-l.first).map((g)=>g.slice(0,2000));return{text:`${f.length} console line(s) from ${l.bundleId} on ${Ee(e)}.`,logs:{lines:f,next:l.first+l.lines.length}}}var ao=new Map;function Ac(e,...c){let l=ao.get(e.udid);if(!l)return;for(let[m,f]of c)if(m>l.width||f>l.height)ye("simulator_point_off_screen",`(${m}, ${f}) is off ${e.name}'s ${l.width}x${l.height}-point screen.`)}function Lc(e,c){if(e.kind==="ipad")return 2;return c===750||c===828||c===640?2:3}async function Rs(e,c=1,l){let m=ys(de(Nc(),"reason-sim-"));try{let f=de(m,"screen.png");if(await He("xcrun",["simctl","io",e.udid,"screenshot","--type=png",f],"Taking a screenshot"),l){ps(ms(l),{recursive:!0});let N=await He("sips",["-g","pixelWidth","-g","pixelHeight",f],"Reading the screenshot size"),M=Number(N.match(/pixelWidth: (\d+)/)?.[1]),U=Number(N.match(/pixelHeight: (\d+)/)?.[1]),F=2/Lc(e,M);await He("sips",["-z",String(Math.round(U*F)),String(Math.round(M*F)),f,"--out",l],"Saving the screenshot")}let g=await He("sips",["-g","pixelWidth","-g","pixelHeight",f],"Reading the screenshot size"),w=Number(g.match(/pixelWidth: (\d+)/)?.[1]),x=Number(g.match(/pixelHeight: (\d+)/)?.[1]),C=Lc(e,w),R=Math.round(w/C),v=Math.round(x/C);ao.set(e.udid,{width:R,height:v});let I=Buffer.alloc(0),L=c===2?Np:Dp;for(let N of[70,50,35]){let M=de(m,`screen-${N}.jpg`);if(await He("sips",["-z",String(v*c),String(R*c),"-s","format","jpeg","-s","formatOptions",String(N),f,"--out",M],"Encoding the screenshot"),I=bs(M),I.byteLength<=L)break}return{text:`Screenshot of ${Ee(e)} at ${R}x${v} points: image pixels are tap coordinates.`+(l?` Saved at ${l}.`:""),device:e,image:{mime:"image/jpeg",data:I.toString("base64"),width:R,height:v}}}finally{Ur(m,{recursive:!0,force:!0})}}async function rm(e){let c=await Uc(e);if(c)try{return String((await c.call({op:"tree"})).tree)}catch{}return so(["describe-ui"],e.udid,"Reading the accessibility tree")}async function co(e){let c=JSON.parse(await rm(e)),l={lines:[],compact:[],ids:new Set,labels:new Set,targets:[]},m=(f,g,w="")=>{let x=(f.role??f.type??"?").replace(/^AX/,""),C=f.AXLabel||f.title||"",R=f.AXValue?` value="${String(f.AXValue).slice(0,120)}"`:"",v=f.AXUniqueId?` id=${f.AXUniqueId}`:"";if(f.AXUniqueId)l.ids.add(f.AXUniqueId);if(C)l.labels.add(C);let I=f.frame;if(x==="Application"&&I&&!l.bounds)l.bounds={width:I.width,height:I.height};if(I&&I.width>0&&I.height>0&&(f.AXUniqueId||f.AXLabel))l.targets.push({...f.AXUniqueId?{id:f.AXUniqueId.trim()}:{},...f.AXLabel?{label:f.AXLabel.trim()}:{},role:x,frame:I});let L=Boolean(C||v||R||!["Group","Other"].includes(x));if(L){let N=`${"  ".repeat(Math.min(g,12))}${x} "${C.slice(0,160)}"${v}${R}`+(I?` (${Math.round(I.x)},${Math.round(I.y)} ${Math.round(I.width)}x${Math.round(I.height)})`:"")+(f.enabled===!1?" disabled":"");l.lines.push(N);let M=x==="Image"&&!v,U=(x==="StaticText"||x==="Image")&&!v&&C!==""&&w.includes(C);if(!M&&!U)l.compact.push(N)}for(let N of f.children??[])m(N,L?g+1:g,C||w)};for(let f of c)m(f,0);return l}function Vc(e,c,l=!1){let m=(l?e.compact:e.lines).join(`
-`);return m.length>c?`${m.slice(0,c)}
-\u2026 (truncated)`:m}async function nm(e){let c=await co(e);return{text:`Accessibility tree of ${Ee(e)} (frames in points; tap by id or label):
-${Vc(c,Mp)}`,device:e}}var om=450,im=1e4;function sm(e,c){let l=c.id?e.ids.has(c.id):[...e.labels].some((m)=>m===c.label||m.includes(c.label));return c.gone?!l:l}async function Mt(e,c,l){let m=c.observe??"tree";if(m==="none"&&!c.wait_for)return l;let f=null,g="";if(c.wait_for){let x=Date.now()+(c.timeout??5)*1000,C=c.wait_for,R=C.id?`id ${C.id}`:`"${C.label}"`;for(;;){if(f=await co(e),sm(f,C)){g=` ${R} is ${C.gone?"gone":"on screen"}.`;break}if(Date.now()>=x){g=C.gone?` Waited ${c.timeout??5} s: ${R} is still on screen.`:` Waited ${c.timeout??5} s: ${R} is not in the visible accessibility tree. Lists only build their visible rows, so check the screen below: it may be open with that element further down (scroll to it), or wait for something at its top.`;break}await Bun.sleep(250)}}else await Bun.sleep(om);let w={...l,text:`${l.text}${g}`};if(m==="tree"||m==="both")f??=await co(e),w.screen=Vc(f,im,!0),w.text+=`
-Screen now:
-${w.screen}`;if(m==="screenshot"||m==="both"){let x=await Rs(e);w.image=x.image}return w}function kc(e){return`'${e.replace(/'/g,"'\\''")}'`}function am(e){switch(e.action){case"tap":if(e.x!==void 0&&e.y!==void 0)return e.duration?`touch -x ${e.x} -y ${e.y} --down --up --delay ${e.duration}`:`tap -x ${e.x} -y ${e.y}`;return e.id?`tap --id ${kc(e.id)}`:`tap --label ${kc(e.label)}`;case"swipe":return`swipe --start-x ${e.x} --start-y ${e.y} --end-x ${e.x2} --end-y ${e.y2} --duration ${e.duration??0.3}`;case"button":return`button ${e.name.replace("_","-")}`;case"sleep":return`sleep ${e.seconds}`}}var Gc=0.35,cm=new Set(["Button","Link","Cell","MenuItem","Switch","Toggle","CheckBox","PopUpButton","TextField","SecureTextField","SearchField","TextArea","Slider","Tab","RadioButton"]);function lm(e,c){let l=e.targets.filter((R)=>c.id!==void 0?R.id===c.id.trim():R.label===c.label?.trim()),m=(R)=>({x:R.frame.x+R.frame.width/2,y:R.frame.y+R.frame.height/2}),f=e.bounds,g=f?l.filter((R)=>{let{x:v,y:I}=m(R);return v>=0&&I>=0&&v<=f.width&&I<=f.height}):l,w=g.length?g:l,x=w.filter((R)=>cm.has(R.role)),C=(x.length?x:w)[0];return C?m(C):null}async function dm(e,c,l,m,f){let g=Date.now()+l*1000;for(;;){let w=lm(await co(e),c);if(w)return w;if(Date.now()>=g){let x=c.id!==void 0?`--id '${c.id}'`:`--label '${c.label}'`;return ye("simulator_element_not_found",`Error: Step ${m} failed: [tap]
-No accessibility element matched ${x}. Make sure the app is on the expected screen, then inspect it and prefer an id when there is one.
-(${m-1} of ${f} steps had completed.)`)}await Bun.sleep(250)}}async function Zt(e,c,l){let m=await Uc(e);if(!m)return Tc(e,c,l);for(let[f,g]of c.entries()){try{switch(g.action){case"tap":{let x=g.x!==void 0&&g.y!==void 0?{x:g.x,y:g.y}:await dm(e,g,l,f+1,c.length);await m.call(g.duration?{op:"tap",...x,duration:g.duration}:{op:"tap",...x});break}case"swipe":await m.call({op:"swipe",x:g.x,y:g.y,x2:g.x2,y2:g.y2,duration:g.duration??0.3});break;case"button":await m.call({op:"button",name:g.name});break;case"type":await m.call({op:"text",text:g.text}).catch((x)=>x instanceof Fr?so(["type",g.text],e.udid,`Step ${f+1} (typing)`):Promise.reject(x));break;case"sleep":await Bun.sleep(g.seconds*1000);break}}catch(x){if(x instanceof Yt)return await Tc(e,c.slice(f),l),`Ran ${c.length} step(s) on ${Ee(e)}.`;if(x instanceof Fr)ye("simulator_command_failed",`Step ${f+1} failed: ${x.message}
-(${f} of ${c.length} steps had completed.)`);throw x}let w=c[f+1];if(g.action!=="sleep"&&w&&w.action!=="sleep")await Bun.sleep(Gc*1000)}return`Ran ${c.length} step(s) on ${Ee(e)}.`}async function Tc(e,c,l){let m=[],f=[],g=0,w=0,x=async()=>{if(m.length===0)return;let C=["batch","--ax-cache","perStep","--wait-timeout",String(l)];for(let R of m)C.push("--step",R);try{await so(C,e.udid,`Steps ${w+1}-${w+g}`)}catch(R){if(R instanceof r){let v=R.message.replace(/Step (\d+) failed/,(I,L)=>{let N=f[Number(L)-1];return N?`Step ${N} failed`:I});ye(R.code,`${v}
-(${w} of ${c.length} steps had completed before this batch.)`)}throw R}w+=g,m=[],f=[],g=0};for(let[C,R]of c.entries()){if(R.action==="type"){await x(),await so(["type",R.text],e.udid,`Step ${w+1} (typing)`),w+=1;continue}m.push(am(R)),g+=1,f.push(C+1);let v=c[C+1];if(R.action!=="sleep"&&v&&v.action!=="sleep")m.push(`sleep ${Gc}`),f.push(C+1)}return await x(),`Ran ${c.length} step(s) on ${Ee(e)}.`}var um=["topLeft","top","topRight","right","bottomRight","bottom","bottomLeft","left"],Dc=new Map,pm=`ObjC.import("AppKit");
-function run(argv) {
-  const [input, output, width, height] = argv;
-  const w = Number(width), h = Number(height);
-  const image = $.NSImage.alloc.initWithContentsOfFile(input);
-  const rep = $.NSBitmapImageRep.alloc.initWithBitmapDataPlanesPixelsWidePixelsHighBitsPerSampleSamplesPerPixelHasAlphaIsPlanarColorSpaceNameBytesPerRowBitsPerPixel(
-    null, w, h, 8, 4, true, false, $.NSDeviceRGBColorSpace, 0, 0);
-  $.NSGraphicsContext.saveGraphicsState;
-  $.NSGraphicsContext.setCurrentContext($.NSGraphicsContext.graphicsContextWithBitmapImageRep(rep));
-  image.drawInRectFromRectOperationFraction($.NSMakeRect(0, 0, w, h), $.NSZeroRect, $.NSCompositingOperationCopy, 1);
-  $.NSGraphicsContext.restoreGraphicsState;
-  rep.representationUsingTypeProperties($.NSBitmapImageFileTypePNG, $()).writeToFileAtomically(output, true);
-}`;async function us(e,c,l){let m=await He("sips",["-g","pixelWidth","-g","pixelHeight",e],"Reading the frame size"),f=Number(m.match(/pixelWidth: ([\d.]+)/)?.[1]),g=Number(m.match(/pixelHeight: ([\d.]+)/)?.[1]);if(l!==void 0)f=f*l/g,g=l;let w=ys(de(Nc(),"reason-chrome-"));try{let x=de(w,"render.js"),C=de(w,"out.png");if(kp(x,pm),await He("osascript",["-l","JavaScript",x,e,C,String(Math.max(1,Math.round(f*c))),String(Math.max(1,Math.round(g*c)))],"Rendering the frame"),!tt(C))ye("simulator_command_failed",`Rendering ${Mc(e)} produced no image.`);return{image:bs(C).toString("base64"),width:f,height:g}}finally{Ur(w,{recursive:!0,force:!0})}}async function mm(e){if(!hs.has(e.udid))await vs();let c=hs.get(e.udid),m=JSON.parse(await He("xcrun",["simctl","list","devicetypes","-j"],"Listing device types")).devicetypes?.find((f)=>f.identifier===c)?.bundlePath;if(!m)ye("simulator_command_failed",`No device type bundle for ${e.name}.`);return m}async function fm(e){let c=await mm(e),l=ao.get(e.udid)??(e.state==="booted"?(await Rs(e),ao.get(e.udid)):void 0);if(!l)ye("simulator_not_booted",`${e.name} is not booted.`);let m=Dc.get(c);if(m)return{text:`Frame of ${Ee(e)}.`,device:e,chrome:m};let f=de(c,"Contents","Resources"),g=JSON.parse(await He("plutil",["-convert","json","-o","-",de(f,"profile.plist")],"Reading the device profile")),w=g.framebufferMask?de(f,`${g.framebufferMask}.pdf`):null,x=w&&tt(w)?await us(w,cs,l.height):null,C=g.chromeIdentifier?.split(".").pop(),R=C?de("/Library/Developer/DeviceKit/Chrome",`${C}.devicechrome`,"Contents","Resources"):"";if(!C||!tt(de(R,"chrome.json")))ye("simulator_command_failed",`${e.name} has no device frame in this Xcode.`);let v=JSON.parse(bs(de(R,"chrome.json"),"utf8")),I={};for(let V of um){let z=v.images[V];if(!z)ye("simulator_command_failed",`${e.name}'s frame has no ${V} piece.`);I[V]=await us(de(R,`${z}.pdf`),cs)}let{sizing:L}=v.images,N={top:L.topHeight,left:L.leftWidth,bottom:L.bottomHeight,right:L.rightWidth},M=l.width+N.left+N.right,U=l.height+N.top+N.bottom,F=[];for(let V of v.inputs??[]){let z=de(R,`${V.image}.pdf`);if(!tt(z))continue;let Y=await us(z,cs),{x:be,y:K}=V.offsets.normal,re=(Ue,De,ln)=>Ue<0?De+Ue-ln:Ue,ee=V.anchor==="left"?{x:be-Y.width,y:re(K,U,Y.height)}:V.anchor==="right"?{x:M+be,y:re(K,U,Y.height)}:V.anchor==="top"?{x:re(be,M,Y.width),y:K-Y.height}:{x:re(be,M,Y.width),y:U+K};F.push({name:V.name,image:Y.image,...ee,width:Y.width,height:Y.height})}let B={identifier:v.identifier,screen:{width:l.width,height:l.height},inset:N,padding:v.images.devicePadding??{top:0,left:0,bottom:0,right:0},pieces:I,buttons:F,...x?{screen_mask:x.image}:{}};return Dc.set(c,B),{text:`Frame of ${Ee(e)}.`,device:e,chrome:B}}var hm=new Set(["simulator_command_failed","simulator_launch_failed","simulator_point_off_screen","simulator_build_no_scheme","simulator_element_not_found","simulator_path_outside_root","simulator_project_not_found"]);async function jr(e){try{return await zc(e)}catch(c){if(c instanceof r&&hm.has(c.code))return{text:c.message,error:c.code};throw c}}async function zc(e){if(!Hr())ye("simulator_xcode_missing","Xcode's iOS Simulator is not available on this Mac.");let c=Gi.safeParse(e.payload);if(!c.success)ye("simulator_invalid_request",c.error.issues.map((m)=>m.message).join("; "));let l=c.data;switch(l.action){case"devices":{let m=await vs(),f=m.filter((g)=>g.state==="booted");return{text:`${f.length} booted (${f.map(Ee).join(", ")||"none"}), ${m.length} available.`,devices:m}}case"boot":{let m=await Wp(await Ge(l.device,{booted:!1}));return{text:`${Ee(m)} is booted.`,device:m}}case"shutdown":{let m=await Ge(l.device,{booted:!1});Rt.get(m.udid)?.stop(),Rt.delete(m.udid);let f=await pr("xcrun",["simctl","shutdown",m.udid]);if(f.code!==0&&!/current state: Shutdown/i.test(f.stderr))ye("simulator_command_failed",f.stderr.trim().slice(-1000));return{text:`${Ee(m)} is shut down.`,device:{...m,state:"shutdown"}}}case"build":{let m=await Ic(l,e.root);return l.wait&&m.build?ds(m.build.id):m}case"build_status":return l.wait?ds(l.build_id):Wc(l.build_id);case"run":{let m=await Ic({...l,action:"build"},e.root),f=await ds(m.build.id,Jp);if(f.build?.status!=="succeeded"||!f.build.app_path)return f;let g=await zc({root:e.root,payload:{action:"launch",app_path:f.build.app_path,...l.device?{device:l.device}:{},...l.steps?{steps:l.steps}:{},...l.observe?{observe:l.observe}:{},...l.wait_for?{wait_for:l.wait_for}:{},...l.timeout!==void 0?{timeout:l.timeout}:{}}});return{...g,text:`Built in ${Math.round(f.build.elapsed_ms/1000)} s. ${g.text}`,build:f.build}}case"launch":{let m=await Qp(l,e.root);if(!m.device)return m;if(l.steps?.length)m.text+=` ${await Zt(m.device,l.steps,l.timeout??8)}`;else if(!l.wait_for)await Bun.sleep(1000);return Mt(m.device,l,m)}case"steps":{let m=await Ge(l.device,{booted:!0});return Mt(m,l,{text:await Zt(m,l.steps,l.timeout??5),device:m})}case"terminate":{let m=await Ge(l.device,{booted:!0});if(Rt.get(m.udid)?.bundleId===l.bundle_id)Rt.get(m.udid)?.stop();return await pr("xcrun",["simctl","terminate",m.udid,l.bundle_id]),{text:`Terminated ${l.bundle_id} on ${Ee(m)}.`,device:m}}case"logs":return tm(await Ge(l.device,{booted:!1}),l.after);case"screenshot":return Rs(await Ge(l.device,{booted:!0}),l.scale,l.save_path?xs(e.root,l.save_path):void 0);case"chrome":return fm(await Ge(l.device,{booted:!1}));case"inspect":return nm(await Ge(l.device,{booted:!0}));case"tap":{let m=await Ge(l.device,{booted:!0}),f=l.x!==void 0&&l.y!==void 0;if(f)Ac(m,[l.x,l.y]);await Zt(m,[f?{action:"tap",x:l.x,y:l.y,...l.duration&&l.duration>0?{duration:l.duration}:{}}:l.id?{action:"tap",id:l.id}:{action:"tap",label:l.label}],3);let g=f?`(${l.x}, ${l.y})`:l.id?`id ${l.id}`:`"${l.label}"`;return Mt(m,l,{text:`Tapped ${g} on ${Ee(m)}.`,device:m})}case"swipe":{let m=await Ge(l.device,{booted:!0});return Ac(m,[l.x,l.y],[l.x2,l.y2]),await Zt(m,[{action:"swipe",x:l.x,y:l.y,x2:l.x2,y2:l.y2,...l.duration!==void 0?{duration:l.duration}:{}}],3),Mt(m,l,{text:`Swiped (${l.x}, ${l.y}) \u2192 (${l.x2}, ${l.y2}) on ${Ee(m)}.`,device:m})}case"type":{let m=await Ge(l.device,{booted:!0});return await Zt(m,[{action:"type",text:l.text}],3),Mt(m,l,{text:`Typed ${l.text.length} character(s) on ${Ee(m)}.`,device:m})}case"button":{let m=await Ge(l.device,{booted:!0});return await Zt(m,[{action:"button",name:l.name}],3),Mt(m,l,{text:`Pressed ${l.name} on ${Ee(m)}.`,device:m})}case"open_url":{let m=await Ge(l.device,{booted:!0}),f;try{f=new URL(l.url)}catch{ye("simulator_invalid_request","open_url needs an absolute URL.")}if(Up.has(f.protocol))ye("simulator_invalid_request",`${f.protocol} URLs are not allowed.`);return await He("xcrun",["simctl","openurl",m.udid,f.href],"Opening the URL"),Mt(m,l,{text:`Opened ${f.href} on ${Ee(m)}.`,device:m})}case"appearance":{let m=await Ge(l.device,{booted:!0});return await He("xcrun",["simctl","ui",m.udid,"appearance",l.mode],"Setting the appearance"),{text:`${Ee(m)} is in ${l.mode} mode.`,device:m}}}}import{mkdtempSync as gm,readFileSync as _m,rmSync as ym}from"fs";import{tmpdir as bm}from"os";import{join as Kc}from"path";import{spawn as Jc}from"child_process";var wm=/^[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}$/i,Wr=1,Sm=[{bit:8,dx:0,dy:1},{bit:16,dx:0,dy:-1},{bit:32,dx:1,dy:0},{bit:64,dx:-1,dy:0}],Yc=60,vm=8,Zc=Hr;var Xc={65293:40,65421:40,65307:41,65288:42,65289:43,65535:76,65360:74,65367:77,65365:75,65366:78,65361:80,65362:82,65363:79,65364:81,65505:225,65506:229,65507:224,65508:228,65513:226,65514:230,65515:227,65516:231,65511:227,65512:231,65509:57},xm=(()=>{let e={" ":44};"abcdefghijklmnopqrstuvwxyz".split("").forEach((l,m)=>{e[l]=4+m,e[l.toUpperCase()]=4+m}),"1234567890".split("").forEach((l,m)=>{e[l]=30+m}),"!@#$%^&*()".split("").forEach((l,m)=>{e[l]=30+m});let c=[["-","_",45],["=","+",46],["[","{",47],["]","}",48],["\\","|",49],[";",":",51],["'",'"',52],["`","~",53],[",","<",54],[".",">",55],["/","?",56]];for(let[l,m,f]of c)e[l]=f,e[m]=f;return e})();function Rm(e){if(Xc[e]!==void 0)return Xc[e];return e>=32&&e<=126?xm[String.fromCharCode(e)]??null:null}function Qc(e,c){let l=Jc("xcrun",["simctl","pbcopy",e],{stdio:["pipe","ignore","ignore"]});l.once("error",()=>{}),l.stdin.end(c)}function Em(e,c){let l=0,m={x:0,y:0},f=(g)=>{c.call(g).catch(()=>{})};return{pointer(g,w,x){let C=(x&Wr)!==0;if(C&&!(l&Wr))f({op:"touch",phase:"down",x:g,y:w});else if(C&&(g!==m.x||w!==m.y))f({op:"touch",phase:"move",x:g,y:w});else if(!C&&l&Wr)f({op:"touch",phase:"up",x:g,y:w});for(let R of Sm)if(x&R.bit&&!(l&R.bit))f({op:"swipe",x:g,y:w,x2:g+R.dx*Yc,y2:w+R.dy*Yc,duration:0.08});l=x,m={x:g,y:w}},key(g,w){let x=Rm(w);if(x!==null)f({op:"key",usage:x,down:g})},clipboard(g){Qc(e,g)},close(){if(l&Wr)f({op:"touch",phase:"up",...m});l=0}}}function Pm(e,c){let l=null,m="",f,g=(w)=>{jr({payload:{...w,device:e,observe:"none"},root:c}).catch(()=>{})};return{pointer(w,x,C){let R=(C&Wr)!==0;if(R&&!l)l={x:w,y:x,at:Date.now()};if(!R&&l){let v=(Date.now()-l.at)/1000;if(Math.hypot(w-l.x,x-l.y)>vm)g({action:"swipe",x:l.x,y:l.y,x2:w,y2:x,duration:Math.min(Math.max(v,0.05),1)});else g({action:"tap",x:l.x,y:l.y,...v>0.5?{duration:Math.min(v,10)}:{}});l=null}},key(w,x){if(!w)return;let C=x===65293?`
-`:x>=32&&x<=126?String.fromCharCode(x):null;if(C===null)return;m+=C,clearTimeout(f),f=setTimeout(()=>{let R=m;m="",g({action:"type",text:R})},250)},clipboard(w){Qc(e,w)},close(){clearTimeout(f),l=null}}}function Cm(e,c,l){return new Promise((m,f)=>{let g=Jc(e,c,{stdio:"ignore",signal:l});g.once("error",f),g.once("exit",(w)=>m(w??-1))})}async function Om(e,c){let l=gm(Kc(bm(),"reason-simulator-stream-"));try{let m=Kc(l,"screen.png");if(await Cm("xcrun",["simctl","io",e,"screenshot","--type=png",m],c)!==0)throw new r("simulator_not_booted","That simulator is not booted.");let f=_m(m).subarray(16,24);return{width:f.readUInt32BE(0),height:f.readUInt32BE(4)}}finally{ym(l,{recursive:!0,force:!0})}}async function el(e,c={}){let{udid:l,...m}=e.payload;if(typeof l!=="string"||!wm.test(l)||!m.video)throw new r("invalid_display_request","Reason simulator stream request is malformed.");let f=await Fc().catch(()=>{throw new r("simulator_axe_missing","AXe could not be installed on this Mac.")}),g=await jr({payload:{action:"screenshot",device:l},root:e.root});if(g.error||!g.image)throw new r("simulator_not_booted","That simulator is not booted.");let w={width:g.image.width,height:g.image.height},x=await as(f),C=x?await jn(f,l,!0):null,R=x?null:await ji();if(!x&&!R)throw new r("display_video_unsupported","This Mac can build neither the simulator host nor find an H.264 ffmpeg.");let v={kind:"simulator",udid:l,axe:f,points:w,sound:null,size:x?w:await Om(l,e.signal),stream:x?(I,L,N)=>Cc(x,l,Math.min(I,60),N,L):null,input:C?Em(l,C):Pm(l,e.root)};return await Pt({payload:m,signal:e.signal},{...c,video:{desktop:async()=>v,...R?{ffmpeg:()=>R}:{}}})}var pl=131072,Um=131072,Hm=128,ml=8192,As=30000,Ls=15000,jm=/^[a-z][a-z0-9_]{0,63}$/,xo=new Set(["jobs.control","fs.read","fs.write"]),tl=new Set(["cancelled","run_finished","run_cancelled","driver_handoff","driver_stopped"]);function po(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&").replace(/[a-z]/gi,(c)=>`[${c.toLowerCase()}${c.toUpperCase()}]`)}function rl(e){return e.map(po).join("/")}function Es(e,c){let l=[];for(let m=0;m<e.length;m+=c)l.push(e.slice(m,m+c));return l}var Wm=[...Es(Se,4).map((e)=>`/(${e.map(rl).join("|")})(/|$)`),...Es(Bt,4).map((e)=>`/(${e.map(rl).join("|")})$`),...Es([...Ft],6).map((e)=>`/(${e.map(po).join("|")})$`),`/${po(".env")}\\.[^/]+$`,`/[^/]+(${jt.map(po).join("|")})$`],Os=new Set(["add","am","apply","branch","checkout","cherry-pick","clean","commit","merge","mv","rebase","remote","reset","restore","revert","rm","stash","switch","tag"]),fl=new Set(["blame","diff","for-each-ref","grep","log","ls-files","rev-list","rev-parse","shortlog","show","status"]);function hl(e){return[e.requiredPermission,...e.additionalPermissions??[]]}function qm(e){return Et(e)}function Is(){if(le()==="darwin")return ut("/usr/bin/sandbox-exec");if(le()==="linux"||le()==="win32")return hr();return!1}function nl(){if(le()==="linux")return ut("/proc");if(le()==="win32")return wt()!==null;if(!Is())return!1;if(le()==="darwin")return ut("/usr/sbin/lsof");return!1}function vi(){return le()==="darwin"?"/bin/zsh":cn()}function Yr(e){return Boolean(e)&&typeof e==="object"&&!Array.isArray(e)}function Vm(e){if(!Yr(e))throw new r("invalid_payload","Operation payload must be an object.");if(Buffer.byteLength(JSON.stringify(e),"utf8")>Ce)throw new r("payload_too_large","Operation payload exceeds 256 KB.");return e}function Sr(e,c){let l=e[c];if(l===void 0||l===null)return;if(typeof l!=="string")throw new r("invalid_payload",`${c} must be a string.`);return l}function go(e,c,l=ml){let m=Sr(e,c);if(!m||Buffer.byteLength(m,"utf8")>l||m.includes("\x00"))throw new r("invalid_payload",`${c} is missing or too large.`);return m}function Gm(e,c,l){let m=e[c];if(typeof m!=="string"||m.includes("\x00")||Buffer.byteLength(m,"utf8")>l)throw new r("invalid_payload",`${c} is missing or too large.`);return m}function Xr(e,c,l,m){if(e===void 0||e===null)return c;if(typeof e!=="number"||!Number.isInteger(e))throw new r("invalid_payload","Expected a bounded integer.");return Math.min(Math.max(e,l),m)}function $t(e,c){if(le()==="win32")[e,c]=[e.toLowerCase(),c.toLowerCase()];return c===e||c.startsWith(`${e}${Bm}`)}function mr(e){if(Zi(e))throw new r("protected_path","This path is on Reason's credential denylist. The Mac's owner can allow it with `reason permissions protected allow <path>` or Request permission in Files.")}function Le(e){let c;try{c=at(e.path)}catch(l){if(process.platform==="darwin"&&rn(l))throw nn(e.path);throw new r("root_unavailable","The granted root is unavailable.")}if(c!==e.path||!Jr(c).isDirectory())throw new r("root_changed","The granted root changed after registration.");return mr(c),c}function ks(e,c="."){if(!c||c.includes("\x00")||Mm(c))throw new r("path_outside_root","Paths must be relative to the granted root.");if(le()==="win32"&&c.split(/[\\/]/).some(Zr))throw new r("invalid_path","Windows reserves this file name.");let l=$m(e,c);if(!$t(e,l))throw new r("path_outside_root","Path escapes the granted root.");return l}function yr(e,c=".",l=!1){let m=ks(e,c),f;try{f=at(m)}catch(g){if(bl(g))throw wl();throw new r("path_not_found","Path does not exist.")}if(!$t(e,f))throw new r("symlink_escape","Path resolves outside the granted root.");if(!l)mr(f);return f}function zm(e,c){let l=ks(e,c);if(mr(l),ut(l)){let g=at(l);if(!$t(e,g))throw new r("symlink_escape","Write target resolves outside the granted root.");if(Ps(l).isSymbolicLink())throw new r("symlink_escape","Writing through a symlink is not allowed.");return mr(g),g}let m=zr(l);while(!ut(m)){let g=zr(m);if(g===m)throw new r("path_outside_root","No safe write parent.");m=g}let f=at(m);if(!$t(e,f))throw new r("symlink_escape","Write parent resolves outside the granted root.");return mr(f),l}function gl(e,c){return Cs(e,c)||"."}function Km(e,c=pl){let l=Buffer.from(e,"utf8");if(l.byteLength<=c)return{value:e,truncated:!1};return{value:l.subarray(0,c).toString("utf8"),truncated:!0}}function _l(e,c){return{...Me({home:e,temporaryDirectory:c}),ZDOTDIR:c,BASH_ENV:"/dev/null",ENV:"/dev/null",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",GIT_OPTIONAL_LOCKS:"0"}}function Ym(e,c,l,m=!1){return["(version 1)","(deny default)",'(import "system.sb")',"(allow process*)",'(allow file-read* (subpath "/opt/homebrew") (subpath "/usr/local"))',...m?['(allow file-read* (subpath "/dev"))']:[],`(allow file-read* (subpath ${JSON.stringify(e)}))`,`(allow file-read* file-write* (subpath ${JSON.stringify(c)}))`,...l?[`(allow file-write* (subpath ${JSON.stringify(e)}))`]:[],...Wm.map((f)=>`(deny file-read* file-write* (regex #"${f}"))`),...Xi(e,l),"(deny network*)"].join(`
-`)}async function en(e,c,l){return new Promise((m,f)=>{let g="",w="",x=!1,C=!1,R=!1,v;try{v=Fm(e,c,{cwd:l.cwd,env:l.env,shell:!1,stdio:["ignore","pipe","pipe"],...Kt()}),Jt(v)}catch(U){f(U);return}let I=(U,F)=>{if(R)return;R=!0,clearTimeout(M),l.signal.removeEventListener("abort",N),m({exitCode:U,signal:F,stdout:g,stderr:w,timedOut:C,truncated:x})},L=(U,F)=>{let B=`${U}${String(F)}`,V=Km(B);return x||=V.truncated,V.value};v.stdout.on("data",(U)=>{g=L(g,U)}),v.stderr.on("data",(U)=>{w=L(w,U)}),v.once("error",f),v.once("exit",I);let N=()=>{try{if(le()==="win32"&&v.pid)Oe(v.pid);else v.kill("SIGTERM")}catch{}};l.signal.addEventListener("abort",N,{once:!0});let M=setTimeout(()=>{C=!0,N()},l.timeoutMs)})}var ol=null;function Xm(){return ol??=Mi({scrubEnvironment:_l,spawnCaptured:en,isProtectedPath:E}),ol}var ko=async(e,c,l)=>{if(le()==="linux"||le()==="win32")return Xm()(e,c,l);if(le()!=="darwin"||!ut("/usr/bin/sandbox-exec"))throw new r("sandbox_unavailable","Confined command execution is unavailable on this operating system.");let m=Lm(ul(Nm(),"reason-device-"));try{return await en("/usr/bin/sandbox-exec",["-p",Ym(l.root,m,l.allowWrite,l.allowProcessInspection===!0),e,...c],{cwd:l.cwd,timeoutMs:l.timeoutMs,signal:l.signal,env:_l(l.root,m)})}finally{Tm(m,{recursive:!0,force:!0})}};function Jm(e){let c=e.args;if(c===void 0)return[];if(!Array.isArray(c)||c.length>Hm)throw new r("invalid_payload","args must be a bounded string array.");return c.map((l)=>{if(typeof l!=="string"||l.includes("\x00")||Buffer.byteLength(l,"utf8")>ml)throw new r("invalid_payload","Command argument is invalid or too large.");return l})}async function yl(e,c,l,m={}){if(e.signal.aborted)throw new r("cancelled","Operation was cancelled.");let f=Le(e.root),g=m.cwd??f,w=await e.runCommand(c,l,{cwd:g,root:f,allowWrite:m.allowWrite===!0,timeoutMs:m.timeoutMs??Ls,signal:e.signal});if(w.exitCode!==0&&/permission denied|operation not permitted|EACCES|EPERM/i.test(w.stderr))await e.emit("permission.denied",{operation:"bash",provenance:e.worker?.executionMode==="unsandboxed"?"os_permission_unknown":"sandbox_policy"});return{exit_code:w.exitCode,signal:w.signal,stdout:w.stdout,stderr:w.stderr,timed_out:w.timedOut,truncated:w.truncated}}function bl(e){let c=e instanceof Error&&"code"in e?e.code:null;return c==="EACCES"||c==="EPERM"}var wl=()=>new r("path_unreadable","The path is not readable.");function Zm(e){try{return dl(e,rt.O_RDONLY)}catch(c){throw bl(c)?wl():c}}function il(e,c){let l=ge()?G():null;return l?kt(l,{op:"fs",capability:e,root:c.root,payload:c.payload},c.signal).then((m)=>m.value):Co(e,c)}function Co(e,c){return e==="fs.read"?Qm(c):tf(c)}async function Qm(e){let c=Le(e.root),l=yr(c,go(e.payload,"path"));if(!Jr(l).isFile())throw new r("not_a_file","Read target is not a file.");let m=Xr(e.payload.offset,0,0,Number.MAX_SAFE_INTEGER),f=Xr(e.payload.max_bytes,65536,1,pl),g=Sr(e.payload,"encoding");if(g!==void 0&&g!=="base64")throw new r("invalid_payload","encoding must be base64.");let w=Zm(l),x,C;try{x=ll(w).size;let v=Buffer.alloc(Math.max(0,Math.min(f,x-m)));C=v.subarray(0,v.byteLength?km(w,v,0,v.byteLength,m):0)}finally{cl(w)}let R=g==="base64"||C.includes(0);return{path:gl(c,l),content:R?C.toString("base64"):C.toString("utf8"),encoding:R?"base64":"utf8",offset:m,bytes:C.byteLength,size:x,truncated:m+C.byteLength<x}}function ef(e,c,l=le()){let m=e==="append"?rt.O_APPEND:rt.O_TRUNC;if(l==="win32")return c?rt.O_WRONLY|(e==="append"?rt.O_APPEND:0):rt.O_WRONLY|rt.O_CREAT|rt.O_EXCL;return rt.O_WRONLY|rt.O_NOFOLLOW|m|(c?0:rt.O_CREAT|rt.O_EXCL)}async function tf(e){let c=Le(e.root),l=go(e.payload,"path"),m=Gm(e.payload,"content",Um),f=Sr(e.payload,"mode")??"overwrite";if(!["create","overwrite","append"].includes(f))throw new r("invalid_payload","mode must be create, overwrite, or append.");let g=zm(c,l);if(e.payload.create_parents===!0||e.payload.create_directories===!0){Am(zr(g),{recursive:!0,mode:448});let R=at(zr(g));if(!$t(c,R))throw new r("symlink_escape","Write parent escaped root.")}if(!ut(zr(g)))throw new r("path_not_found","Write parent does not exist.");if(f==="create"&&ut(g))throw new r("path_exists","Create mode will not overwrite an existing file.");let w=ut(g),x=w?Ps(g):null,C=dl(g,ef(f,w),384);try{let R=ll(C),v=x??(le()==="win32"?Ps(g):null);if(v&&(R.ino!==v.ino||R.dev!==v.dev||le()==="win32"&&!$t(c,at(g))))throw new r("symlink_escape","The write target changed between validation and opening.");if(le()==="win32"&&x&&f!=="append")Im(C,0);Dm(C,m,null,"utf8")}finally{cl(C)}return{path:gl(c,g),bytes_written:Buffer.byteLength(m,"utf8"),mode:f}}async function rf(e){let c=Le(e.root),l=go(e.payload,"command",65536),m=yr(c,Sr(e.payload,"cwd")??".");if(!Jr(m).isDirectory())throw new r("invalid_cwd","cwd is not a directory.");let f=Xr(e.payload.timeout_ms,Ls,100,As);return yl(e,vi(),["-lc",l],{cwd:m,allowWrite:e.root.permissions.write,timeoutMs:f})}async function nf(e){let c=ia.safeParse(e.payload),l=e.worker;if(!c.success||!e.claimOwner||(l?!l.runtimeDirectory:le()!=="darwin"))throw new r("preview_unavailable","Preview servers are unavailable on this computer.");let m=Le(e.root),f=ne(m,c.data.workspace),g=f.boundary===m?m:yr(f.anchor,Cs(f.anchor,f.boundary)||"."),w=yr(g,Cs(g,f.path)||".");if(!Jr(w).isDirectory())throw new r("invalid_cwd","The Session checkout is not a directory.");let x=Math.min(Date.parse(c.data.expires_at),Date.now()+ra);if(!(x>Date.now()))throw new r("process_authority_lost","The preview server lease is unavailable.");let C=(B)=>e.emit("progress",{process:B});if(!l?.runtimeDirectory){if(e.claim.local_github_authority)throw new r("local_device_gh_confinement_unavailable","Only a worker runs a local GitHub Session's dev server.");return{...await Uo({claim:e.claim,root:g,cwd:w,command:c.data.command,mode:"host",shell:Gt(),environment:process.env,expiresAtMs:x,signal:e.signal,emit:C})}}let R={directory:ul(l.runtimeDirectory,"processes")},v={deniedPorts:tr([e.apiOrigin])},I=or(),L=sr(),N=ge(),M=c.data.egress?bt(N):null;if(c.data.egress&&(M===null||!me(l.executionMode==="unsandboxed")))throw new r("preview_egress_unavailable","This computer cannot hold a dev server to the run's network allowlist; no command was dispatched.");let U=c.data.egress?await ga(c.data.egress.allowed_domains):null,F=U?[`export ${["HTTP_PROXY","HTTPS_PROXY","http_proxy","https_proxy"].map((B)=>`${B}=${U.url}`).join(" ")}`,"export NO_PROXY=localhost,127.0.0.1,::1 no_proxy=localhost,127.0.0.1,::1 NODE_USE_ENV_PROXY=1",c.data.command].join(`
-`):c.data.command;try{return{...await Uo({claim:e.claim,root:w,cwd:w,command:F,mode:"host",shell:L,expiresAtMs:x,signal:e.signal,emit:C,...N?{jobsUser:{...N,...M!==null?{modelGid:M}:{}}}:{},environment:{...I.variables,HOME:I.home,PATH:I.path,TMPDIR:I.temporaryDirectory,SHELL:L},journals:R,preview:v})}}finally{U?.close()}}async function of(e){bi();let c=Le(e.root),l=wi(e.payload.command),m=yr(c,Sr(e.payload,"cwd")??".");if(!Jr(m).isDirectory())throw new r("invalid_cwd","cwd is not a directory.");let f=Xr(e.payload.timeout_ms,Wa,100,_i),{ignored:g}=Ii(e.payload.env);return await e.emit("progress",{shell:Gt(),shell_flags:[...$r],sandbox:"none",ignored_env:g}),Va({command:l,cwd:m,timeoutMs:f,signal:e.signal,spawn:e.spawnFullControl,requestEnv:e.payload.env})}async function sf(e){let c=Le(e.root),l=Jm(e.payload),m=l[0];if(!m||!fl.has(m)&&!Os.has(m))throw new r("git_command_not_allowed","Git subcommand is not in the Device allowlist.");if(l.some((w)=>w==="-C"||w==="-c"||w.startsWith("--git-dir")||w.startsWith("--work-tree")||w.startsWith("--config-env")||w.startsWith("--exec-path")))throw new r("git_argument_not_allowed","Git path/config overrides are not allowed.");let f=Os.has(m);if(f&&!e.root.permissions.write)throw new r("permission_denied","Mutating Git commands require the write grant.");let g=yr(c,Sr(e.payload,"cwd")??".");return yl(e,"git",["-c","core.hooksPath=/dev/null","-c","credential.helper=",...l],{cwd:g,allowWrite:f||process.platform==="win32"&&e.root.permissions.write,timeoutMs:Xr(e.payload.timeout_ms,Ls,100,As)})}function Sl(e,c){return async(l)=>{let m=await e.runCommand("/usr/sbin/lsof",l,{cwd:c,root:c,allowWrite:!1,allowProcessInspection:!0,timeoutMs:1e4,signal:e.signal});if(e.signal.aborted)throw new r("cancelled","Operation was cancelled.");return m}}async function af(e){let c=Le(e.root);if(le()==="linux")return tc(c);if(le()==="win32")return Si(c);return sc(c,Sl(e,c))}async function cf(e){let c=Le(e.root);if(le()==="linux")return rc(c);if(le()==="win32")return Ei(c);return ac(c,Sl(e,c))}var fr=new Map;function vl(e){let c,l={promise:new Promise((m)=>{c=m}),grant:c};return fr.set(e,l),()=>{if(fr.get(e)===l)fr.delete(e)}}function es(e){if(e.capability!=="hands.connect"||!Yr(e.payload)||e.payload[Ae]!==!0)return()=>{};return vl(e.operation_id)}function ts(e,c){if(e.capability!=="hands.connect"||c.kind!==pt||!Yr(e.payload)||e.payload[Ae]!==!0)return!1;return fr.get(e.operation_id)?.grant(),!0}async function lf(e){let{[Ae]:c,...l}=e.payload;if(c!==void 0&&(c!==!0||!e.worker))throw new r("invalid_payload","Reason sent an invalid workspace grant request.");let m=c===!0&&!fr.has(e.operationId)?vl(e.operationId):()=>{};try{return await df({...e,payload:l},c===!0?fr.get(e.operationId).promise:void 0)}finally{m()}}async function df(e,c){let l=e.worker?fc(e.worker):null,m=e.claim.environment;delete e.claim.environment;let f=e.worker&&m&&Ts({deviceId:e.deviceId},e.root.id,e.runId,m.payload,m.authority)?m.payload:void 0;return e.runHandsRelay({...c?{workspaceGrant:c}:{},...e.claimedAtMs===void 0?{}:{claimedAtMs:e.claimedAtMs},claimOwner:e.claimOwner,...f?{claimEnvironment:f}:{},localGithubConfinement:Boolean(e.claim.local_github_authority),...e.worker?{headless:!0,runtimeDirectory:e.worker.runtimeDirectory,...e.worker.handsSlots?{handsSlots:e.worker.handsSlots}:{},...e.worker.ownComputer?{ownComputer:!0}:{},hostExecution:e.worker.executionMode==="unsandboxed",...e.worker.executionMode==="unsandboxed"&&e.worker.readiness?.["pty.start"]===!0?{managedPty:{version:1,startupVerified:!0}}:{},deviceIdentity:{deviceId:e.deviceId,rootId:e.root.id,apiOrigin:e.apiOrigin},...l?{desktopRecording:l}:{}}:{},root:Le(e.root),runId:e.runId,operationId:e.operationId,attemptId:e.attemptId,payload:e.payload,signal:e.signal,emitEvent:(g,w,x)=>e.emit(g,w,x)})}async function uf(e){if(e.worker){if(!e.root.permissions.read||!e.root.permissions.write)throw new r("permission_denied","Bound Hands terminals require the workspace read/write grants.");let{workspace:c,session:l}=xi(e.payload,e.operationId);return Pi({root:Le(e.root),runId:e.runId,deviceId:e.deviceId,rootId:e.root.id,workspace:c,session:l,owner:e.claimOwner,authority:e.claimAuthority,signal:e.signal,emit:(m,f)=>e.emit(m,f)})}return e.runPtySession({root:Le(e.root),runId:e.runId,operationId:e.operationId,payload:e.payload,signal:e.signal,emitEvent:(c,l)=>e.emit(c,l)})}function sl(e,c){let l=ge()?G():null;return l?kt(l,{op:"transfer",direction:c,root:e.root,payload:e.payload,worker:Boolean(e.worker)},e.signal).then((m)=>m.value):Ao(c,{root:e.root,payload:e.payload,signal:e.signal,worker:Boolean(e.worker),fetchImpl:e.fetchImpl,beforeCommit:()=>e.emit("progress",{phase:"file_transfer_verified"})})}async function Ao(e,c){let l=Le(c.root),m=Dr in c.payload;if(m&&!c.worker)throw new r("cloud_copy_workspace_invalid","Only a worker resolves a Cloud copy workspace.");let f=m?Fa(l,c.payload[Dr]):l;if("source"in c.payload||"source_version"in c.payload){if(e!=="export"||!m)throw new r("cloud_copy_source_unsupported","Explicit sources require the private Cloud exporter.");let x=Ca.safeParse(c.payload);if(!x.success)throw new r("invalid_payload","Invalid Cloud export request.");return Ua({runtimeRoot:f,source:x.data.source,url:x.data.url,signal:c.signal,fetchImpl:c.fetchImpl})}let g=go(c.payload,"path",4096),w=e==="import"&&m?gi(f):f;return mr(ks(w,g)),Wt({direction:e,root:w,path:g,payload:c.payload,signal:c.signal,fetchImpl:c.fetchImpl,beforeCommit:c.beforeCommit})}var xl={"inference.custom.v1":{requiredPermission:"read",additionalPermissions:["execute","discover_environment"],execute:(e)=>{if(!e.customEndpointCredential||!e.claimOwner)throw new r("custom_endpoint_credential_unavailable","Local model credentials require a signed Device claim.");return Us({payload:e.payload,signal:e.signal,credential:e.customEndpointCredential,emit:(c,l)=>e.emit(c,l,e.signal)})}},"fs.read":{requiredPermission:"read",execute:(e)=>il("fs.read",e)},"fs.write":{requiredPermission:"write",execute:(e)=>il("fs.write",e)},"fs.export":{requiredPermission:"read",execute:(e)=>sl(e,"export")},"fs.import":{requiredPermission:"write",execute:(e)=>sl(e,"import")},"preview.serve.v1":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:()=>le()==="darwin"&&yi(),execute:nf},"exec.run":{requiredPermission:"execute",available:Is,execute:rf},"exec.full":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:()=>yi(),execute:of},"git.run":{requiredPermission:"execute",available:()=>Is()&&qm("git"),execute:sf},"process.list":{requiredPermission:"read",additionalPermissions:["discover_environment"],available:nl,execute:af},"ports.list":{requiredPermission:"read",additionalPermissions:["discover_environment"],available:nl,execute:cf},"hands.connect":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],available:()=>le()==="darwin"||Boolean(on()),execute:lf},"pty.start":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:_n,execute:uf},"display.stream.v1":{requiredPermission:"execute",additionalPermissions:["discover_environment"],available:At,execute:(e)=>{let c=G();return c?kt(c,{op:"display",payload:e.payload,proxy:(e.relay.loadProxy??j)()},e.signal):Pt({payload:e.payload,signal:e.signal},e.relay)}},"automation.call.v1":{requiredPermission:"execute",additionalPermissions:["read","discover_environment"],available:()=>mn(),execute:(e)=>gn({runId:e.runId,payload:e.payload,signal:e.signal,...e.worker?.userChrome?{userChrome:e.worker.userChrome}:{}})},"simulator.call.v1":{requiredPermission:"execute",additionalPermissions:["read","discover_environment"],available:Hr,execute:(e)=>jr({payload:e.payload,root:Le(e.root)})},"simulator.stream.v1":{requiredPermission:"execute",additionalPermissions:["read","discover_environment"],available:Zc,execute:(e)=>el({payload:e.payload,root:Le(e.root),signal:e.signal},e.relay)},"jobs.control":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],available:()=>!0,execute:(e)=>Ti({root:Le(e.root),runId:e.runId,payload:e.payload,signal:e.signal})},"github.local.v1":{requiredPermission:"read",additionalPermissions:["execute","discover_environment"],available:()=>le()==="darwin"?ut("/usr/bin/sandbox-exec"):le()==="linux"||le()==="win32",execute:async(e)=>{let c=ke.parse(e.payload),l=ie.parse(e.claim.local_github_authority);if(l.userId!==e.claimOwner?.user_id||l.deviceId!==e.deviceId||l.rootId!==e.root.id||l.runId!==e.runId||l.repoFullName!==c.repoFullName||!l.readOnly&&!e.root.permissions.write||!Ve(c)&&(l.readOnly||l.generation===null&&!(c.kind==="pr_merge"&&l.merge?.source==="human")&&!(c.kind==="pr_mutation"&&l.contributorRefresh)))throw Error("local_device_gh_authority_changed");return Ri({root:Le(e.root),runId:e.runId,request:c,authority:l,signal:e.signal,leaseUntil:e.claim.lease_until},(m)=>Qs(c,m))}},"environment.install":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],execute:async(e)=>Je({root:Le(e.root),runId:e.runId,payload:e.payload})},"browser.pr-proof.v1":{requiredPermission:"read",additionalPermissions:["execute"],available:()=>!1,execute:async(e)=>{if(!e.proveMac)throw new r("capability_unsupported","PR proof host is not installed.");return e.proveMac()}},"tunnel.open":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],execute:(e)=>Ci({root:Le(e.root),runId:e.runId,owner:e.claimOwner,payload:e.payload,signal:e.signal})},"tunnel.close":{requiredPermission:"execute",additionalPermissions:["read","write","discover_environment"],execute:(e)=>Ai({root:Le(e.root),runId:e.runId,owner:e.claimOwner,payload:e.payload,signal:e.signal})},"workspace.setup.v1":{requiredPermission:"execute",additionalPermissions:["read","write"],available:mi,execute:(e)=>$a(e.payload,e.signal)}};function pf(e,c){try{let l=js(e,at(c)),m=l?e.find((f)=>f.path===l):void 0;return m&&/^[a-f0-9]{64}$/.test(m.pathFingerprint)?m.pathFingerprint:void 0}catch{return}}function mf(e,c){try{let l=at(c);return e.some((m)=>m.path===l)?wn(l,le()):void 0}catch{return}}function ff(e,c){try{let l=at(c),m=e.find((f)=>f.path===l);return m&&/^[a-f0-9]{64}$/.test(m.pathFingerprint)?m.pathFingerprint:void 0}catch{return}}function hf(e,c){try{let l=at(c);if(!e.some((m)=>m.path===l))return;return e.filter((m)=>m.path!==l&&$t(l,m.path)&&/^[a-f0-9]{64}$/.test(m.pathFingerprint)).map((m)=>m.pathFingerprint)}catch{return}}function Po(e,c,l=le()){try{return wo({home:wn(at(c),l),roots:e.map((m)=>({path_fingerprint:m.pathFingerprint,path:wn(m.path,l)})).filter((m)=>/^[a-f0-9]{64}$/.test(m.path_fingerprint)&&bn(m.path)).slice(0,bo)})}catch{return}}function rs(e,c={}){let l=c.worker?c.worker.handsSlots??1:c.handsSlots===1?1:void 0,m=Boolean(c.worker)||le()==="darwin",f=m?ff(e,qr()):void 0,g=!c.worker&&le()==="darwin"?pf(e,qr()):void 0,w=m?mf(e,qr()):void 0,x=!c.worker&&le()==="darwin"?hf(e,qr()):void 0,C=m?Po(e,qr()):void 0,R=Ha.filter((v)=>{if(Mr.has(v)&&!c.worker)return!1;if(c.worker&&!Ln(v,c.worker))return!1;let I=xl[v];if(!I)return!1;return(v==="hands.connect"&&(c.terminalOnlyHands===!0||Boolean(c.worker))||(v==="pty.start"||v==="preview.serve.v1")&&Boolean(c.worker)||v==="browser.pr-proof.v1"&&Boolean(c.productionProof)?!0:I.available?.()??!0)&&e.some((N)=>(!c.worker||v!=="pty.start"||N.permissions.read&&N.permissions.write)&&hl(I).every((M)=>N.permissions[M]))});return{supported_operations:R,...f?{account_root_fingerprint:f}:{},...g?{workspace_root_fingerprint:g}:{},...w?{account_root_path:w}:{},...x?{home_contained_root_fingerprints:x}:{},...C?{root_paths:C}:{},...R.includes("hands.connect")?{hands_worker_artifact_sha256:S,hands_worker_entrypoint:O,...l?{hands_slots:l}:{}}:{},max_payload_bytes:Ce,max_result_bytes:Ce,operation_constraints:{...R.includes("browser.pr-proof.v1")&&c.productionProof?{"browser.pr-proof.v1":Io.parse(c.productionProof)}:{},...R.includes("exec.run")?{"exec.run":{transport:"shell",shell:vi(),sandbox:le()==="linux"?"linux_sandbox_runtime":le()==="win32"?"windows_srt":"macos_seatbelt",network:!1,max_timeout_ms:As}}:{},...R.includes("exec.full")?{"exec.full":Ga()}:{},"git.run":{read_only_subcommands:[...fl].sort(),mutating_subcommands:[...Os].sort(),push:!1,credential_helpers:!1},"fs.export":{transport:"https_signed_url",max_bytes:ft,max_timeout_ms:Tr,result:"sha256_and_size"},"fs.import":{transport:"https_signed_url",max_bytes:ft,max_timeout_ms:Tr,atomic:!0,overwrite:!1},"hands.connect":{transport:"wss_relay",worker:"ara_hands",worker_version:D,protocol_version:k,worker_artifact_sha256:S,worker_entrypoint:O,policy_mode:"full_access",policy_version:1,workspace_base:ue,workspace_layout:J,...l?{slots:l}:{},browser_state:c.worker?"optional_headless":c.terminalOnlyHands===!0?"disabled_terminal_only":le()==="darwin"?"optional_isolated_per_session":"isolated_per_session",max_session_ms:43200000},...R.includes("pty.start")?{"pty.start":{transport:"wss_relay",shell:"login_shell",resize:!0,slots:br,max_session_ms:wr,max_buffered_output_bytes:Tt}}:{},...c.worker?Object.fromEntries(R.filter((v)=>v!=="browser.pr-proof.v1").map((v)=>[v,{ready:c.worker?.readiness?.[v]===!0,...c.worker?.readiness?.[v]!==!0&&c.worker?.probing?.includes(v)?{probing:!0}:{},execution_mode:Ln(v,{...c.worker,executionMode:"sandboxed"})?"confined":"host",...v==="pty.start"?{transport:"wss_relay",worker:"ara_hands",shell:"bound_job",protocol_version:Nt,environment:"private_snapshot",receipt:"metadata_only",...c.worker?.persistentTerminals&&!ge()?{persistent_terminals:!0}:{}}:{},...v==="github.local.v1"?{contributor_attribution:2,prepare_diagnostics:1,...c.worker?.githubSignedIn!==void 0?{gh_authenticated:c.worker.githubSignedIn}:{}}:{},...v==="hands.connect"?{transport:"wss_relay",worker:"ara_hands",slots:l,session_group:ii,...c.worker?.ownComputer?{[oi]:si}:{},workspace_base:ue,workspace_layout:J,browser_state:"optional_headless",desktop:!1,worker_version:D,protocol_version:k,...c.worker?.readiness?.["environment.install"]===!0&&R.includes("environment.install")?{environment_delivery:Fn,[Hn]:Un}:{},...c.worker?{[Kn]:Wn}:{},...c.worker?{[zn]:qn}:{},...c.worker?{[Gn]:Vn}:{},...c.worker?.handsBrowser?{[Qn]:Yn}:{},[Xn]:Zn,[ti]:ei,...me(c.worker?.executionMode==="unsandboxed")?{[X]:pe}:{},...me(c.worker?.executionMode==="unsandboxed")&&bt()!==null?{[q]:Pe}:{},...me(c.worker?.executionMode==="unsandboxed")&&ge()?{[ni]:ri}:{}}:{},...v==="fs.export"?{cloud_source_version:Pn,source_kinds:["workspace","attachment"],[Vo]:Go}:{},...v==="fs.import"?{[Vo]:Go}:{},...v===ta&&bt()!==null&&me(c.worker?.executionMode==="unsandboxed")?{[oa]:No}:{},...v==="tunnel.open"?{carried_jobs:ai}:{},...v==="jobs.control"?{[li]:ci}:{},...v==="display.stream.v1"&&c.worker?.displayVideo?{[Qi]:Yi,[eo]:ot.join(","),[to]:ro,[no]:io}:{},...v==="automation.call.v1"&&c.worker?.userChrome?{[ht]:!0}:{},...v==="automation.call.v1"&&c.worker?.cloudSessions?{[ui]:!0}:{}}])):{}}}}function Ts(e,c,l,m,f){let g=ir.safeParse(m);return g.success&&f!==void 0&&f.device_id===e.deviceId&&g.data.device_id===e.deviceId&&g.data.root_id===c&&g.data.run_id===l&&g.data.binding.kind===f.binding&&g.data.binding.target_revision===f.target_revision&&g.data.binding.root_grant_revision===f.root_grant_revision&&g.data.binding.target_generation===f.target_generation&&g.data.binding.target_fence_id===f.target_fence_id}async function ns(e,c,l,m,f){if(c.capability!=="hands.connect"||l.kind!==dt||!m.operationEnvironment||!m.acknowledgeOperationEnvironment)return!1;let g=l.payload.snapshot_id;if(l.payload.version!==1||typeof g!=="string"||Object.keys(l.payload).length!==2)throw new r("environment_unavailable","Reason sent an invalid environment delivery.");let w=e.roots.find((R)=>R.id===c.root_id);if(!w)throw new r("root_not_granted","The Hands root is no longer granted.");let x=await m.operationEnvironment(e,c,g,f);if(!Ts(e,w.id,c.run_id,x.payload,x.authority)||x.payload.snapshot_id!==g)throw new r("environment_unavailable","The delivered environment does not match this Hands.");let C=Je({root:Le(w),operationId:c.operation_id,payload:x.payload});return await m.acknowledgeOperationEnvironment(e,c,{snapshot_id:C.snapshot_id,installed_revision:C.installed_revision,installed:!0},f),!0}async function is(e,c,l,m){if(c.capability!=="hands.connect"||l.kind!==Jn)return!1;let{version:f,run_id:g,target_generation:w,target_fence_id:x}=l.payload;if(f!==1||Object.keys(l.payload).length!==4||typeof g!=="string"||typeof w!=="number"||typeof x!=="string")throw new r("hands_rebind_unavailable","Reason sent an invalid Hands rebind.");let C=e.roots.find((R)=>R.id===c.root_id);if(!C)throw new r("root_not_granted","The Hands root is no longer granted.");return await ki({operationId:c.operation_id,root:Le(C),runId:g,targetGeneration:w,fenceId:x,...m?{signal:m}:{}}),!0}async function os(e,c,l){if(c.capability!=="github.local.v1")return al(e,c,l);try{let m=await al(e,c,l);if(m.status==="succeeded"||$n(c.payload,m.status,m.error_code))return m;return{status:m.status,error_code:m.status==="cancelled"?"operation_cancelled":"local_github_unavailable"}}catch{return{status:l.signal.aborted?"cancelled":"failed",error_code:l.signal.aborted?"operation_cancelled":"local_github_unavailable"}}}async function al(e,c,l){if(Mr.has(c.capability)&&!l.worker)return{status:"failed",error_code:"capability_not_granted"};if(l.worker&&!Ln(c.capability,l.worker))return{status:"failed",error_code:"capability_not_granted"};if(l.worker&&l.worker.readiness?.[c.capability]!==!0)return{status:"failed",error_code:"capability_unavailable"};if(c.local_github_authority){let v=ie.safeParse(c.local_github_authority);if(!v.success||v.data.deviceId!==e.deviceId||v.data.rootId!==c.root_id||v.data.runId!==c.run_id||v.data.userId!==c.owner?.user_id||!["github.local.v1","hands.connect","environment.install","jobs.control","preview.serve.v1"].includes(c.capability))return{status:"failed",error_code:"local_device_gh_capability_denied"}}let m=xl[c.capability];if(!m)return{status:"failed",error_code:"capability_unsupported"};if(m.available&&!m.available()&&!(["hands.connect","pty.start","preview.serve.v1"].includes(c.capability)&&l.worker)&&!l.runCommand&&!l.runHandsRelay&&!l.spawnFullControl&&!l.runPtySession&&!(c.capability==="browser.pr-proof.v1"&&l.proveMac))return{status:"failed",error_code:"capability_unavailable"};if(c.protocol_version!==2)return{status:"failed",error_code:"protocol_unsupported"};let f=e.roots.find((v)=>v.id===c.root_id);if(!f)return{status:"failed",error_code:"root_not_granted"};if((c.capability==="fs.export"||c.capability==="fs.import")&&Yr(c.payload)&&(("source"in c.payload)||("source_version"in c.payload))){let v=Boolean(l.worker||e.worker)&&Dr in c.payload;if(c.capability!=="fs.export"||!v)return{status:"failed",error_code:"cloud_copy_source_unsupported"}}if(c.owner&&(c.owner.device_id!==e.deviceId||c.owner.organization_id!==e.orgId))return{status:"failed",error_code:"capability_not_granted"};if((c.capability==="tunnel.open"||c.capability==="tunnel.close")&&!c.owner)return{status:"failed",error_code:"preview_unavailable"};if(c.capability==="environment.install"&&!Ts(e,f.id,c.run_id,c.payload,c.authority))return{status:"failed",error_code:"environment_unavailable"};if(hl(m).some((v)=>!f.permissions[v]))return{status:"failed",error_code:"permission_denied"};let g=0,w=async(v,I,L)=>{if(["environment.install","github.local.v1"].includes(c.capability)||c.capability==="inference.custom.v1"&&(v==="started"||v==="completed"))return;await l.emit?.({sequence:g++,kind:v,capability:c.capability,data:I,...(v==="hands.reconnected"||c.capability==="inference.custom.v1")&&L?{deliverySignal:L}:{}})},x=c.capability==="hands.connect"||c.capability==="display.stream.v1"||c.capability==="simulator.stream.v1"||xo.has(c.capability)||c.capability==="pty.start",C,R=async(v,I,L)=>{let N=C;C=void 0,await Promise.all([N,w(v,I,L)])};try{if(x)C=w("started"),C.catch(()=>{return});else await w("started");let v={...l.proxy===void 0?{}:{loadProxy:()=>l.proxy??null},...l.handsLaunch?.takePrespawnedWorker?{takePrespawnedWorker:l.handsLaunch.takePrespawnedWorker}:{},...l.handsLaunch?.adoptSpawnedWorker?{adoptSpawnedWorker:l.handsLaunch.adoptSpawnedWorker}:{}},I=await m.execute({...l.proveMac?{proveMac:()=>l.proveMac(c,l.signal,(L)=>w("pr-proof.started.v1",L))}:{},claim:c,worker:l.worker,claimOwner:c.owner,claimAuthority:c.authority,organizationId:e.orgId,deviceId:e.deviceId,apiOrigin:e.apiOrigin,root:f,payload:Vm(c.payload),runId:c.run_id,operationId:c.operation_id,attemptId:c.attempt_id,...l.handsLaunch?{claimedAtMs:l.handsLaunch.claimedAtMs}:{},signal:l.signal,...l.customEndpointCredential?{customEndpointCredential:l.customEndpointCredential}:{},fetchImpl:l.fetchImpl??fetch,relay:v,runCommand:l.runCommand??ko,spawnFullControl:l.spawnFullControl??en,emit:x?R:w,runHandsRelay:l.runHandsRelay??((L)=>vt(L,v)),runPtySession:l.runPtySession??yn});if(c.capability==="github.local.v1")ho.parse(I);if(!Yr(I))throw new r("invalid_result","Operation result must be a JSON object.");if(Buffer.byteLength(JSON.stringify(I)??"null","utf8")>Ce)throw new r("result_too_large","Operation result exceeds 256 KB.");return await(x?R:w)("completed",{ok:!0}),{status:"succeeded",result:I,error_code:null}}catch(v){let I=l.signal.reason instanceof r&&tl.has(l.signal.reason.code)?l.signal.reason.code:v instanceof r&&tl.has(v.code)?v.code:null;if(l.signal.aborted||I)return{status:"cancelled",...v instanceof Lr?{result:{process_terminal_observation:v.observation}}:{},error_code:["environment.install","github.local.v1","inference.custom.v1"].includes(c.capability)?"operation_cancelled":I??"cancelled"};if(["fs.read","fs.write"].includes(c.capability)&&v instanceof Error&&"code"in v&&["EACCES","EPERM"].includes(String(v.code)))await w("permission.denied",{operation:c.capability==="fs.read"?"read":"write",provenance:"os_permission_unknown"});let L=c.capability==="inference.custom.v1"?v instanceof r&&fn(v.code)?v.code:"custom_endpoint_unavailable":c.capability==="github.local.v1"?v instanceof Vt&&$n(c.payload,"failed",v.code)?v.code:"local_github_unavailable":c.capability==="environment.install"?"environment_install_failed":v instanceof r&&jm.test(v.code)?v.code:"capability_failed",N=c.capability==="hands.connect"&&v instanceof lr?Oi(v.expiryDiagnostic):null;return await w("completed",{ok:!1,error_code:L,...N?{expiry_diagnostic:N}:{}}),{status:"failed",error_code:L}}}
-export{Qr,xo,vi,en,ko,Co,es,ts,Ao,Po,rs,ns,is,os};